auric-reach-3o9[.]pages[.]dev

Analysis of the domain auric-reach-3o9.pages.dev indicates it was involved in a credential phishing campaign prior to being taken offline. The domain, registered through Cloudflare, Inc. on February 21, 2026, resolved to the IP address 188.114.96.3, which is associated with Cloudflare's autonomous system (AS13335) in the United States. Infrastructure analysis reveals the use of Cloudflare nameservers (sergi.ns.cloudflare.com and maria.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1), suggesting an attempt to leverage trusted certificate authorities to appear legitimate. The domain was flagged by 15 of 93 security vendors on VirusTotal, though the exact nature of the phishing content remains unverified due to the site's current offline status (HTTP 403).

The page title, 'Suspected phishing site | Cloudflare,' further corroborates its classification as malicious by the hosting provider. Gridinsoft assigned a trust score of 0/100, and the domain appeared on at least one security blocklist, reinforcing its elevated risk designation. Technologies detected include HSTS and HTTP/3, which are consistent with modern phishing infrastructure designed to evade detection and enhance perceived credibility. While the specific brand or service being impersonated is not confirmed in the available data, the scam type is classified as credential phishing.

Defenders should treat this domain as malicious and prioritize blocking it at the DNS or network level. Given its registration under Cloudflare Pages and the use of Cloudflare's infrastructure, organizations may also consider monitoring for similar subdomains under the pages.dev namespace. No additional details about the phishing kit or targeted sectors are available at this time.