postiflare-app[.]pages[.]dev

postiflare-app.pages.dev was observed on 24 July 2026 as an offline site serving a page titled “Postiflare – AI‑Powered Content Creation”. The domain was registered on 19 July 2025 through Cloudflare, Inc., and resolves to the Cloudflare edge address 172.66.47.157, which is announced by AS13335 in the United States. The TLS certificate is issued by Google Trust Services under the WE1 root, and the site enforces HSTS and HTTP/3, indicating a modern web stack. A scan on VirusTotal returned three positive detections out of ninety‑five vendors, and the domain appears on a single external blocklist. PhishDestroy has also listed the domain as malicious.

The Gridinsoft trust score is 0 out of 100, reinforcing the low reputation. An HTTP request to the host returns a 403 status code, consistent with the site being taken offline. The nameserver configuration includes bonnie.ns.cloudflare.com, brodie.ns.cloudflare.com, ns.cloudflare.com and ns2.cloudfla, all owned by Cloudflare. Analysis confirms that the domain is being used for a generic phishing campaign, as indicated by the supplied threat type. The exact phishing payload, credential‑stealing page, or targeted brand has not been captured; only the page title is known.

Because the infrastructure relies on Cloudflare’s CDN, the underlying IP address may host unrelated legitimate services, complicating direct takedown. Defenders should immediately block the domain and its associated IP address at perimeter defenses, add the domain to internal URL filtering lists, and monitor for any future resolution changes. Continuous re‑scanning of the domain through VirusTotal or similar services is advised to capture any new detections. Organizations should also enforce strict TLS inspection policies to detect potential malicious content served from Cloudflare edge nodes, and consider reporting the domain to additional blocklist operators to increase coverage.