b766ee68[.]simplew[.]pages[.]dev

Analysis of the domain b766ee68.simplew.pages.dev indicates that it is currently offline but was previously identified as a credential phishing site. The domain resolves to the IP address 172.66.44.128, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The hosting infrastructure is protected by Cloudflare, as evidenced by the presence of HSTS, support for HTTP/3, and the Cloudflare‑provided SSL certificate issued by Google Trust Services under the WE1 label. The site returned an HTTP 403 status code when accessed, and the page title extracted from the response was "Suspected phishing site | Cloudflare," confirming that the page was flagged by Cloudflare itself as malicious.

Google Safe Browsing classified the URL as a social engineering threat, and Gridinsoft assigned a trust score of 0 out of 100, indicating a high confidence of malicious intent. The domain has been blocked by the PhishDestroy community blocklist and appears on at least one additional security blocklist. VirusTotal scanned the domain with 95 security vendors; 13 of those vendors flagged the domain as malicious, providing further corroboration of the phishing classification. Registration information shows the domain was created through Cloudflare, Inc., and no authoritative nameservers were resolved (NS_NOT_FOUND).

While the exact content of the phishing page has not been publicly disclosed, the combined evidence from certificate data, HTTP response, blocklist entries, and multiple vendor detections provides a strong indication that the domain was used for credential harvesting. Defenders should immediately add the domain to outbound and inbound filtering rules, monitor for any residual traffic to the associated IP address, and consider updating threat intelligence feeds to include this indicator. Ongoing observation is advised in case the infrastructure is repurposed for future campaigns.