xa60k-com[.]pages[.]dev

On July 29, 2026, analysis identified xa60k-com.pages.dev as an active phishing infrastructure with an elevated risk rating. The domain was created on September 30, 2025 and is hosted via Cloudflare Pages, indicating the use of a legitimate content‑delivery service to obscure malicious intent. It appears on a single security blocklist and is specifically listed by PhishDestroy, confirming that at least one anti‑phishing provider has taken automated action to block the domain.

VirusTotal scans show that nine out of ninety‑one security vendors have flagged the domain as malicious, providing independent corroboration of its threat status. The limited blocklist presence suggests that broader detection ecosystems have not yet fully propagated the indicator, increasing the likelihood of exposure to unprotected clients. No additional intelligence such as IP address, ASN, or geographic location is available, leaving the hosting environment partially opaque.

Defenders should prioritize immediate blocking of xa60k-com.pages.dev at network perimeter and DNS filtering layers, incorporate the domain into internal threat‑intel feeds, and monitor for any related subdomains or Cloudflare Pages deployments that share similar creation timestamps. Continuous re‑evaluation is advised, as additional detections may emerge from broader security vendors or community blocklists, potentially expanding the observed surface of the campaign.