pl5iqnogtq[.]pages[.]dev

This domain is flagged as an elevated-risk phishing site specializing in Polish-language prize scams, as indicated by the page title 'Gratulacje' (Congratulations). The infrastructure is designed to deceive users into believing they have won a prize, a common social engineering tactic targeting Polish-speaking victims. Analysis indicates the domain was operational for a short period before being taken offline, suggesting a disposable phishing campaign. Infrastructure analysis reveals the domain was registered on January 25, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.44.100. Detection metrics show minimal coverage, with only 1 out of 95 security vendors flagging the domain on VirusTotal. The domain appears on a single security blocklist and has a Gridinsoft trust score of 0/100. Technologies detected include HSTS, Cloudflare CDN, and HTTP/3, while the SSL certificate is issued by Google Trust Services. The use of Cloudflare infrastructure and modern protocols may have been intended to evade detection and lend credibility to the scam. Mitigation for this threat involves blocking the domain and its resolving IP (172.66.44.100) at the network perimeter. Organizations should implement DNS filtering to prevent access to newly registered domains (NRDs) with low reputation scores, particularly those using Cloudflare or similar CDN services. End-user education should emphasize skepticism toward unsolicited prize notifications, especially those delivered via unfamiliar domains. Security teams are advised to monitor for additional domains registered under the same infrastructure or using identical page titles, as threat actors frequently reuse templates across campaigns.