bermita-nqx-zormela-p7t8dw13[.]pages[.]dev

This domain, bermita-nqx-zormela-p7t8dw13.pages.dev, is actively flagged as a phishing threat by multiple security sources as of August 6, 2026. Infrastructure analysis reveals the domain resolves to IP address 172.66.44.91, a Cloudflare-hosted endpoint commonly used to mask origin servers. The domain appears on two security blocklists and is explicitly blocked by PhishDestroy and OpenPhish, indicating confirmed malicious activity targeting user credentials. VirusTotal reports 13 of 91 security vendors detecting the domain as malicious, providing further evidence of its fraudulent nature.

The exact content and targeted brand of the phishing site are not yet analysed, though the domain structure and hosting pattern suggest an attempt to mimic legitimate login portals. No registration or creation date is available in current intelligence, limiting temporal context. The use of Cloudflare Pages infrastructure is consistent with observed phishing campaigns leveraging free hosting services to reduce costs and evade takedowns.

Defenders should treat this domain as an active credential-harvesting threat and implement blocking at DNS, proxy, or endpoint levels. Security teams are advised to monitor for connections to 172.66.44.91 and correlate with user reports of suspicious login prompts. Further analysis of HTTP headers, SSL certificates, and page content is recommended to identify specific phishing kits or targeted services, though no evidence currently links this domain to a known kit or brand.