d67a0008[.]ajkevmslay[.]pages[.]dev

The domain d67a0008.ajkevmslay.pages.dev was registered through Cloudflare, Inc. on February 21, 2026 and is hosted on the Cloudflare network (AS13335) with the IP address 188.114.96.3 located in the United States. No TLS certificate is associated with the host, indicating that the site does not present a valid HTTPS connection. The page title returned by the server is "Suspected phishing site | Cloudflare," which suggests that the endpoint has been identified as a phishing landing page, though the specific target brand or credential‑stealing vector has not been disclosed in the available intelligence.

The domain has been actively blocked by the PhishDestroy service and appears on a single security blocklist, confirming that at least one defensive feed has flagged it for malicious activity. VirusTotal analysis shows that 12 of 95 security vendors have marked the domain as malicious, providing a modest but notable consensus of threat. The site is currently offline, which may be the result of takedown actions or the operator’s own cessation of activity.

Uncertainties remain regarding the exact phishing campaign details, such as the lure content, payload delivery method, and whether any victims have been compromised before the shutdown. Defenders should continue to monitor the IP address 188.114.96.3 for any re‑use by related actors, enforce blocklisting of the domain in perimeter defenses, and consider adding the host to internal threat‑intel feeds. Additional investigation of the domain’s historical DNS records and any archived page snapshots could reveal further indicators of compromise that were not captured before the site went offline.