# norva-kelra-biz-sunor-zxha22526z-glanex.pages.dev — MALICIOUS

> norva-kelra-biz-sunor-zxha22526z-glanex.pages.dev is a high-risk phishing domain flagged and taken offline. Stay vigilant and avoid interaction with this site.

## Summary
PhishDestroy identifies norva-kelra-biz-sunor-zxha22526z-glanex.pages.dev as a confirmed generic phishing domain. The domain was newly created on March 3, 2026, and classified with a high-risk phishing threat level based on observed malicious intent and associated indicators.

Technical analysis reveals this domain resolves to the IP address 172.66.47.142 and is registered through Cloudflare, Inc. It appears on one security blocklist and is flagged by 10 out of 95 security vendors on VirusTotal, substantiating the phishing classification. Its page title was detected as "Suspected phishing site | Cloudflare," indicating direct intervention by the hosting provider.

Due to the threat, norva-kelra-biz-sunor-zxha22526z-glanex.pages.dev has been taken offline, minimizing user exposure. Users are advised to remain cautious and avoid any interaction with this domain or similar Cloudflare-hosted phishing infrastructure. Monitoring and blocking should continue to prevent attempts to resurrect or utilize this domain for malicious purposes.

## Threat Details
- Verdict: MALICIOUS
- Site status: dead (HTTP 403)
- Page title: Suspected phishing site | Cloudflare

## Domain Intelligence
- Registered: 2026-03-03 01:00:02
- Registrar: Cloudflare, Inc.
- Country: US
- IP: 172.66.47.142
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: brady.ns.cloudflare.com ximena.ns.cloudflare.com
- SSL Issuer: Let's Encrypt / E8

## Detection Status
- VirusTotal: 10 vendors flagged
  Vendors: ["ADMINUSLabs", "alphaMountain.ai", "CyRadar", "DNS8", "Emsisoft", "G-Data", "Gridinsoft", "Netcraft", "Sophos", "Webroot"]
- Google Safe Browsing: clean
- Blocklists: 1 hits
  Lists: ["PhishDestroy"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019cb116-4d15-746e-b308-a04352eccb32.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/bf3f8d3e-f20b-4a4c-8b9e-d7a11fa90132
- Wayback Machine: https://web.archive.org/web/https://norva-kelra-biz-sunor-zxha22526z-glanex.pages.dev
- PhishDestroy: https://phishdestroy.io/domain/norva-kelra-biz-sunor-zxha22526z-glanex.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/norva-kelra-biz-sunor-zxha22526z-glanex.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/norva-kelra-biz-sunor-zxha22526z-glanex.pages.dev/
Last updated: 2026-03-19