pjbrq1dqtwil-txmknnnx-2b3c7d-tx999a[.]pages[.]dev

The domain pjbrq1dqtwil-txmknnnx-2b3c7d-tx999a.pages.dev is currently active and has been classified as a generic phishing infrastructure. DNS resolution points to the IPv4 address 172.66.44.61, indicating that the host is likely served from a shared cloud platform. The domain has been flagged by the PhishDestroy blocklist, and it appears on an additional security blocklist, confirming that at least two independent threat‑intelligence sources consider it malicious. VirusTotal analysis shows that 13 out of 91 security vendors have reported the domain as malicious, providing modest but consistent detection across the scanning ecosystem.

No further metadata such as registrar information, SSL certificate details, HTTP response codes, or page title has been disclosed, leaving the exact content of the landing page unverified at this time. The limited visibility suggests that the adversary may be employing a short‑lived or rapidly rotated site to evade extensive profiling. Defenders should immediately block the domain at perimeter firewalls and web‑proxy solutions, add the associated IP address 172.66.44.61 to deny‑list rules, and incorporate the domain into local threat‑intel feeds.

Continuous monitoring for new resolutions of the same IP range is advisable, as the attacker may redeploy the phishing payload under different sub‑domains. Organizations that have observed phishing attempts targeting their users should cross‑reference any recent suspicious URLs with this indicator to determine potential exposure. The evidence base is currently confined to DNS resolution, blocklist presence, and vendor detections; further investigation, such as sandbox analysis of the live page, would be required to refine the attribution and understand any payload delivery mechanisms.