cvtmahjonggakena[.]pages[.]dev

This domain, cvtmahjonggakena.pages.dev, is actively serving a high-risk phishing site targeting online gambling users. Analysis indicates the page title explicitly references 'MAHJONGWIN138' and 'Perkumpulan Slot Gacor Mahjong,' suggesting a focus on fraudulent gambling or slot machine-themed scams. The domain was registered on March 6, 2026, and remains operational as of July 12, 2026, resolving to IP 172.66.45.12 (US, AS13335 Cloudflare, Inc.). Infrastructure is hosted behind Cloudflare nameservers (alexis.ns.cloudflare.com, holly.ns.cloudflare.com), a common tactic to obscure origin and evade takedowns. The site returns an HTTP 200 status, indicating active content delivery, and employs SSL via Let's Encrypt (certificate E8), which does not validate legitimacy. Technologies detected include AMP, Lightbox, HSTS, and HTTP/3, typical of modern web delivery but neutral in threat assessment. Security vendor detection is minimal, with only 2 of 94 engines flagging the domain on VirusTotal, though this does not preclude malicious intent. The domain appears on one security blocklist, corroborating its classification as phishing. Defenders should treat this domain as confirmed malicious, block resolution at DNS and network levels, and monitor for related subdomains or IPs within the same Cloudflare ASN. No specific brand impersonation beyond the gambling theme is confirmed, and the exact phishing mechanics remain unanalyzed due to lack of page inspection. Further investigation into associated Cloudflare-hosted domains may reveal broader campaign infrastructure.