# thexqub.pages.dev — SUSPICIOUS

> thexqub.pages.dev hosts generic phishing targeting login credentials. VirusTotal shows 0/95 detections. Verify legitimacy via the full report.

## Summary
thexqub.pages.dev is a recently activated domain leveraging Cloudflare Pages to host generic phishing pages designed to harvest user credentials. This infrastructure has not yet been widely flagged, with VirusTotal returning 0 detections across 95 engines. The domain resolves to IP 172.66.44.152 using a Google Trust Services SSL certificate, indicating an attempt to appear legitimate.  This domain was flagged due to its active hosting of phishing content under Cloudflare's Pages service, a known method for rapidly deploying malicious sites. The threat is classified as generic phishing because it does not imitate a specific brand but instead uses deceptive login forms to capture user inputs. With no current blocklist presence and all VirusTotal engines silent, this domain remains under investigation while actively phishing targets.  Users who visited thexqub.pages.dev should immediately check for unauthorized logins on their accounts, change passwords if any credentials were entered, and enable two-factor authentication where possible. If you suspect interaction with this domain, disconnect from the internet, run a malware scan, and monitor financial accounts for suspicious activity. Report any incidents to your IT team or security provider for further analysis.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 172.66.44.152

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/9f692b84-4bd6-42f2-80b5-6fc48383617d
- PhishDestroy: https://phishdestroy.io/domain/thexqub.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/thexqub.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/thexqub.pages.dev/
Last updated: 2026-03-22