595b2566[.]rsetw[.]pages[.]dev

This domain, 595b2566.rsetw.pages.dev, was observed hosting a page titled “Suspected phishing site | Cloudflare”. The site was registered through Cloudflare on 2026-03-03 and resolves to the Cloudflare‑owned address 188.114.96.3, which belongs to AS13335 in the United States. No TLS certificate was presented, indicating that the service was delivered over plain HTTP. Reputation checks show a Gridinsoft trust score of 0 out of 100, and three independent blocklists have already listed the domain.

VirusTotal analysis recorded three positive detections out of ninety‑three scanning engines, confirming that at least a small subset of security products consider the domain malicious. The domain is currently taken offline, and it has been explicitly blocked by the PhishDestroy, MetaMask, and SEAL filtering services. The combination of a recent creation date, lack of encryption, low trust score, and multiple vendor flags points to an active phishing infrastructure that was likely used shortly after registration. Because the site is no longer reachable, direct payload collection is not possible, but the IP address and hosting details remain static and can be used for network‑level blocking.

Defenders should add 188.114.96.3 to deny lists, enforce DNS filtering for the full domain, and monitor Cloudflare‑registered subdomains for similar rapid‑creation patterns. Continuous re‑scanning of the domain on VirusTotal or similar aggregators is advised in case the site is re‑hosted. At present, the primary uncertainty is the exact phishing campaign target, as the page title provides no indication of the victim brand or credential type. Until further content is observed, security teams should treat the domain as a high‑confidence phishing indicator and apply appropriate preventative controls.