182a066d[.]connwl[.]pages[.]dev

Analysis of 182a066d.connwl.pages.dev indicates a confirmed phishing domain hosted on Cloudflare's infrastructure. The domain, registered through Cloudflare, Inc. on February 21, 2026, resolves to IP address 172.66.47.165 (AS13335, United States). At the time of assessment, the domain is offline, displaying a Cloudflare interstitial page titled 'Suspected phishing site | Cloudflare,' which aligns with its detection status across multiple security platforms. Google Safe Browsing categorizes the domain under 'social engineering,' and PhishDestroy has actively blocked it.

The domain appears on at least one security blocklist, reinforcing its classification as malicious. While no SSL certificate is present, this is not uncommon for phishing pages hosted on content delivery networks. VirusTotal reports 16 detections from security vendors, though the specific payload or phishing kit remains unconfirmed due to the domain's current offline status. Defenders should treat this domain as high-risk, particularly given its association with Cloudflare Pages, a platform occasionally exploited for rapid phishing deployment.

The absence of SSL does not mitigate risk, as many phishing campaigns operate without encryption to evade initial scrutiny. Network-level blocking of 172.66.47.165 and monitoring for subdomains under connwl.pages.dev is recommended. No brand impersonation or specific scam type (e.g., credential harvesting, payment fraud) has been verified in available data, so generic phishing defenses should be applied.