xenvor-biz-qarlit-4n03t26[.]pages[.]dev

The domain xenvor-biz-qarlit-4n03t26.pages.dev has been identified as a fake login portal designed to harvest user credentials. Analysis indicates the site is currently offline, though it previously operated as an active credential theft endpoint. No specific brand impersonation was confirmed, but the structure and content align with generic login phishing tactics. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on April 07, 2026, and resolves to the IP address 172.66.47.182. Security vendor detections include 14 of 95 flags on VirusTotal, while trust assessment platforms report scores of 1 out of 100 and 0 out of 100. The domain appears on one security blocklist, and its SSL certificate was issued by Let's Encrypt. The page title, Suspected phishing site | Cloudflare, further corroborates its malicious classification. The domain has been taken offline, reducing immediate risk to users. However, organizations should proactively block the domain and associated IP address in network security controls. End users are advised to verify the legitimacy of login portals before entering credentials and to monitor accounts for unauthorized access. Security teams should review logs for connections to 172.66.47.182 or related subdomains to identify potential prior exposure.