r392ir23[.]pages[.]dev

This domain, r392ir23.pages.dev, presents a deceptive Cloudflare human verification page designed to harvest user credentials or personal information. The site exploits the familiar Cloudflare interface to trick visitors into believing they must complete a security check, potentially leading to account compromise or malware installation. Analysis indicates the page title explicitly reads 'CloudFlare - Verify that you are a human,' a common tactic to lower user suspicion during phishing attempts. Infrastructure analysis reveals the domain was registered on June 29, 2025, through Cloudflare, Inc., and currently resolves to the IP address 104.21.80.1, hosted under AS13335 (Cloudflare, Inc.). Despite its recent creation, the domain has not yet been flagged by major detection engines, with VirusTotal reporting 0 out of 95 security vendors identifying it as malicious. However, it appears on at least one security blocklist, suggesting early recognition of its fraudulent nature. The SSL certificate is issued by Google Trust Services, adding a superficial layer of legitimacy. Users who have visited r392ir23.pages.dev should immediately cease interaction and avoid entering any credentials. If login details were submitted, affected accounts should be secured by changing passwords and enabling multi-factor authentication where available. Devices used to access the site should undergo a full security scan to detect potential malware or unauthorized access. Given the domain’s active status and lack of widespread detection, caution is advised when encountering similar Cloudflare-themed verification prompts.