apex-hold[.]pages[.]dev

The domain apex-hold.pages.dev was registered through Cloudflare on 21 February 2026 and resolves to the IP address 172.66.47.112, which belongs to AS13335 Cloudflare, Inc. in the United States. The site presents the page title “Suspected phishing site | Cloudflare” and returns an HTTP 403 status code, indicating that access is denied when the page is requested. The TLS certificate is issued by Google Trust Services under the WE1 identifier, confirming that the connection is encrypted but does not imply legitimacy. VirusTotal has recorded 15 of 93 security‑vendor detections for this domain, and the domain is listed on a single external blocklist.

Independent phishing‑mitigation service PhishDestroy has already taken the domain offline. Reputation services assign extremely low scores: Scamadviser rates it 1 out of 100 and Gridinsoft rates it 0 out of 100. The nameservers in use are jade.ns.cloudflare.com and ryan.ns.cloudflare.com, both typical of Cloudflare‑hosted services. The technology fingerprint shows HTTP/3 and HSTS support, which are common for Cloudflare‑protected sites but do not affect the malicious assessment.

The observed indicators collectively point to a credential‑phishing operation, although the exact target or credential‑collection page has not been captured. Because the domain is already offline, immediate mitigation consists of adding the host to firewall deny lists, updating URL filtering policies, and ensuring that any cached references are purged from internal threat‑intel feeds. Continuous monitoring of the IP address range and associated Cloudflare nameservers is advised, as malicious actors frequently recycle infrastructure under the same provider. Defenders should also consider sharing the indicator set with upstream threat‑sharing communities to improve collective blocking.