quiklysol[.]pages[.]dev

quiklysol.pages.dev is an active domain created on 26 March 2026 and currently resolves to the Cloudflare IP address 188.114.96.3, which is geo‑located in Canada. The domain is delegated to the Cloudflare nameservers miles.ns.cloudflare.com and zita.ns.cloudflare.com, and the TLS certificate is issued by Google Trust Services under the WE1 authority, indicating that the site is served through Cloudflare’s edge network with HTTP/3 and HSTS enabled. The page title returned by the HTTP 200 response reads “Dex Tools | Simple and secure interface that integrates seamlessly with your bro”, a title unrelated to the claimed Microsoft impersonation. The intelligence set classifies the activity as a brand‑impersonation investment scam employing an “Airdrop” phishing kit. It has been blocked by PhishDestroy and appears on a single security blocklist; the Gridinsoft trust score is 0/100, reflecting a high confidence of malicious intent. No public malware detections are reported, and VirusTotal scans have not yielded detections, but the absence of detections does not confirm safety. The infrastructure indicates a low‑cost, quickly provisioned hosting setup typical of opportunistic campaigns. Analysts should treat the domain as malicious, block network connections to the IP and DNS name, and monitor for similar Cloudflare‑hosted domains that reference Microsoft or investment‑related terminology. Further forensic analysis of the page content and any submitted credentials is required to confirm the exact phishing vector.