vxmzk0cskra-wjnhf98zwur-2e3f0c-gtb51a[.]pages[.]dev

Analysis as of August 07, 2026 indicates that the domain vxmzk0cskra-wjnhf98zwur-2e3f0c-gtb51a.pages.dev is actively being used in a phishing campaign and is classified with an elevated risk level. The domain is hosted on Cloudflare Pages, as shown by the registrar information, and resolves to the IPv4 address 172.66.44.196. Infrastructure checks reveal that the domain appears on two independent security blocklists and has been explicitly listed by PhishDestroy and OpenPhish, both of which specialize in phishing feed aggregation. VirusTotal scans have returned ten positive detections out of ninety‑one security vendors, confirming that multiple independent scanners have observed malicious behavior associated with this host.

No additional metadata such as SSL certificate details, HTTP response codes, or page titles is currently available, and the content of the site has not been publicly disclosed. Consequently, the exact brand or service being spoofed remains unknown, and the specific phishing lure (login page, credential‑harvesting form, etc.) cannot be described at this time. Defenders should treat the domain as hostile: add it to URL filtering policies, block traffic at the network perimeter, and monitor DNS logs for any resolution attempts.

Continuous re‑scanning of the host is advised, as threat actors may modify the payload or host new phishing pages under the same Cloudflare Pages sub‑domain. Organizations using cloud‑based email gateways should ensure that phishing‑detection rules are updated to include this indicator of compromise. Because the domain is already listed on reputable blocklists and has multiple vendor detections, proactive blocking is the most effective mitigation step while further forensic analysis of the site content is pursued.