0145-53l[.]pages[.]dev

0145-53l.pages.dev was first registered on February 21, 2026 through Cloudflare, Inc. The domain resolves to the IP address 172.66.45.16, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. No TLS certificate is presented for the host, indicating that the site was served over plain HTTP. The only visible page element captured is the title “Important Notification”, suggesting a generic notification‑style lure typical of phishing campaigns.

VirusTotal records show that two of ninety‑five scanned security vendors flagged the domain as malicious, and the domain appears on a single external blocklist operated by PhishDestroy. As of the report date, July 24, 2026, the site has been taken offline, and no active HTTP response was observed. The limited detection footprint and the short lifespan of the domain point to a fast‑flux style deployment often used to evade takedown.

However, the absence of a certificate, the reliance on Cloudflare’s shared infrastructure, and the small number of vendor detections leave uncertainty about the full scope of the campaign, including the specific credential‑harvesting vectors and targeted brands. Defenders should proactively block the domain and its resolving IP address at network perimeter devices, add the host to internal phishing and URL filtering lists, and monitor Cloudflare‑registered domains for re‑registration of similar prefixes. Ongoing telemetry collection from DNS logs and any future VirusTotal or sandbox analyses should be reviewed to determine whether the infrastructure is reused in subsequent campaigns.