grass-3p6[.]pages[.]dev

The domain grass-3p6.pages.dev was created on February 21, 2026 and is currently taken offline. DNS resolution points to IP 172.66.44.105, which belongs to AS13335 Cloudflare, Inc., confirming that the site was hosted behind Cloudflare’s edge network. The SSL certificate is issued by Google Trust Services under the WE1 designation, and the site enforces HSTS while supporting HTTP/3, indicating a modern Cloudflare deployment. An HTTP request to the root returned a 403 status code, and the page title reported by the server is "Suspected phishing site | Cloudflare," matching the classification of a credential phishing operation.

Reputation services assign extremely low trust scores (Scamadviser 11/100, Gridinsoft 0/100), and fifteen independent security blocklists—including PhishDestroy, ScamSniffer, and Enkrypt—have listed the domain. VirusTotal analysis shows that 11 of 95 scanned vendors flagged the domain as malicious, reinforcing the suspicion. The registrar information shows registration through Cloudflare, Inc., with nameservers sue.ns.cloudflare.com and rob.ns.cloudflare.com, which are typical for Cloudflare‑hosted domains.

No additional content, target brand, or phishing kit details have been disclosed beyond the generic page title. Defenders should immediately add grass-3p6.pages.dev to deny‑lists, monitor for any re‑registration or similar sub‑domains under the same Cloudflare account, and correlate activity against the associated IP address range. Continuous ingestion of blocklist updates and vigilance for new detections from the same security vendors are recommended to mitigate potential reuse of this infrastructure.