xelvora-nqx-belxeta-r4t3hk96[.]pages[.]dev

On August 07, 2026, the domain xelvora-nqx-belxeta-r4t3hk96.pages.dev was identified as an active generic phishing infrastructure with an elevated risk rating. Technical analysis shows the hostname resolves to the IP address 172.66.45.7, which is hosted by Cloudflare Pages, indicating the attacker is leveraging a legitimate content‑delivery platform to mask malicious activity. The domain has been listed on two public blocklists and is actively blocked by the PhishDestroy and OpenPhish filtering services, confirming that multiple threat‑intel feeds consider it malicious. VirusTotal scans report that 13 of 91 security vendors flagged the domain, providing independent corroboration of its suspicious nature. The registration details reveal the site was provisioned through Cloudflare’s Pages service, a common choice for adversaries seeking rapid deployment and built‑in DDoS protection.

While the available data confirms the domain’s association with credential‑theft campaigns, no public information about the specific landing page content, SSL certificate details, or HTTP response codes has been disclosed. Consequently, defenders lack visibility into the exact tactics, techniques, and procedures employed by the operators, such as the exact credential‑capture form or any secondary payload delivery mechanisms.

Given the current evidence, security teams should block or sinkhole the domain at the network perimeter, update intrusion‑detection signatures to include the observed IP address, and add the hostname to internal allow‑lists of malicious URLs. Continuous monitoring of Cloudflare‑hosted subdomains is recommended, as the attacker may generate additional pages under the same service. Organizations should also consider reviewing user‑education materials to highlight the risk of unsolicited login requests that originate from obscure .pages.dev URLs.