web-hold-cdn-home[.]pages[.]dev

web-hold-cdn-home.pages.dev was first observed on March 6 2026 when the domain was registered through Cloudflare, Inc. The domain resolves to the Cloudflare‑owned IP 188.114.96.3, which belongs to AS13335 located in the United States. DNS records show the authoritative nameservers bowen.ns.cloudflare.com and magdalena.ns.cloudflare.com. The site presented a page titled “Suspected phishing site | Cloudflare” and returned HTTP 403 when accessed, indicating that the content has been taken offline. Multiple threat intelligence sources have flagged the domain.

Google Safe Browsing lists it as a social‑engineering threat, and three independent blocklists (PhishDestroy, MetaMask, SEAL) have added it to their deny lists. VirusTotal recorded detections from ten of ninety‑four scanned security vendors, reinforcing the malicious classification. The Gridinsoft trust score is 0 out of 100, and the SSL certificate presented is issued by Google Trust Services under the WE1 entity, which is typical for Cloudflare‑hosted sites but does not mitigate the phishing risk. Overall confidence that the domain was used for a generic phishing campaign is high, as evidenced by the page title, multiple vendor detections, and inclusion on reputable blocklists.

The current offline status prevents immediate interaction, but the infrastructure – Cloudflare hosting, US‑based IP, and standard TLS certificate – may be reused for future campaigns. Defenders should continue to block the domain at perimeter devices, update URL filtering policies, and monitor for any re‑registration or reuse of the same IP address. Additional investigation of any associated URLs or payloads observed in network logs is recommended to capture the full scope of the campaign.