lurex-hold[.]pages[.]dev

The domain lurex-hold.pages.dev has been identified as a phishing site specifically designed to impersonate Cloudflare security alerts. Analysis indicates this infrastructure was actively used for credential harvesting, presenting users with fraudulent login interfaces to steal authentication details. The domain is currently offline, but prior activity suggests it targeted users through deceptive security notifications. Infrastructure analysis reveals multiple high-confidence threat indicators. The domain was created on November 26, 2025, and registered through Cloudflare, Inc. It resolved to IP address 188.114.96.3, hosted on AS13335 (Cloudflare, Inc.) infrastructure in the United States. Security vendors detected malicious activity with 20 of 95 engines on VirusTotal flagging the domain as malicious. The domain appears on two security blocklists and is explicitly blocked by PhishDestroy and PhishingDB. The SSL certificate was issued by Google Trust Services (WE1), providing a false sense of legitimacy to potential victims. Current status shows the domain has been taken offline, likely due to detection and enforcement actions. Despite its inactive state, the infrastructure remains a documented threat. Organizations should implement immediate protective measures including DNS-level blocking of the domain and IP address 188.114.96.3. Security teams are advised to review logs for connections to this infrastructure and conduct user awareness training on recognizing spoofed security alerts. The creation date and rapid detection by multiple security vendors indicate this was a short-lived but high-risk campaign targeting users through social engineering tactics.