cry5t4lm3th[.]pages[.]dev

Analysis indicates that the domain cry5t4lm3th.pages.dev is currently active and has been observed in a single security blocklist. Registration information shows the domain is provisioned through Cloudflare, Inc., with authoritative name servers listed as sullivan.ns.cloudflare.com and zoe.ns.cloudflare.com. DNS resolution points to the IPv4 address 188.114.97.3, which is part of Cloudflare’s edge network. The domain has been submitted to VirusTotal, where 91 independent scanning engines have evaluated the host and, at the time of review, none have raised a detection.

The lack of detections should not be interpreted as confirmation of benign behavior, as static scans may miss active phishing delivery mechanisms. The domain is also listed by the PhishDestroy blocklist, confirming its classification as a generic phishing host. No additional public intelligence such as Safe Browsing, OTX, SSL certificate details, HTTP response codes, or page title information is presently available.

Consequently, the confidence in the attribution relies primarily on the blocklist inclusion and the registrar/IP context. Defenders should add the domain to inbound and outbound filtering rules, monitor DNS queries for the associated IP address, and consider expanding existing URL filtering policies to cover the .pages.dev subdomain space. Continuous re‑evaluation is advised, given the potential for rapid content changes typical of phishing infrastructure.