mkrjb04nhwu-pldwffynt-5d2e8f-vzk96a[.]pages[.]dev

Analysis of the domain mkrjb04nhwu-pldwffynt-5d2e8f-vzk96a.pages.dev indicates active malicious infrastructure as of August 06, 2026. The domain resolves to the IPv4 address 172.66.47.130 and is listed on a single security blocklist, where it is specifically blocked by PhishDestroy. VirusTotal scans show that 7 out of 91 security vendors have flagged the domain, suggesting a consensus of malicious intent among a subset of scanners.

The presence on a blocklist and multiple vendor detections align with the generic phishing classification, implying the site is likely used for credential harvesting or related credential‑theft operations. No additional intelligence such as registrar details, SSL certificate attributes, HTTP response codes, or Safe Browsing verdicts is currently available, leaving the broader hosting context and potential payload delivery mechanisms uncertain. Defenders should prioritize blocking the domain at network perimeter devices, updating DNS filtering rules to include the observed blocklist entry, and monitoring outbound connections to the associated IP address.

Continuous re‑scanning of the domain on VirusTotal and other multi‑engine platforms is recommended to capture any changes in detection status. Organizations should also enforce multi‑factor authentication and educate users about unsolicited login prompts, as these controls mitigate the impact of credential‑theft attempts originating from this infrastructure.