tundra-grid[.]pages[.]dev

This domain, tundra-grid.pages.dev, was created on 21 February 2026 and is registered through Cloudflare, Inc. The authoritative nameservers are chin.ns.cloudflare.com and chance.ns.cloudflare.com, both belonging to Cloudflare’s DNS service. DNS resolution returns the IPv6 address 2606:4700:310c::ac42:2f4f, which maps to a Cloudflare edge node in the United States (AS13335). The site presents a TLS certificate issued by Google Trust Services under the WE1 label, and the HTTPS endpoint enforces HSTS and supports HTTP/3, indicating a modern Cloudflare‑enabled deployment. The only visible page title is “Suspected phishing site | Cloudflare”, and an HTTP 403 response is returned, suggesting that the content is being blocked by Cloudflare’s protective rules.

Independent analysis by PhishDestroy confirms the block, and the domain appears on a single security blocklist. Reputation services assign extremely low trust scores (Gridinsoft 0/100, Scamadviser 1/100). VirusTotal records show that 15 of 93 scanning engines flag the domain as malicious, reinforcing the classification as a credential‑phishing site. Because the site is currently offline, direct payload inspection is not possible, and the exact phishing landing page or targeted brand cannot be confirmed.

Nevertheless, the combination of low trust scores, multiple vendor detections, and active blocklisting provides sufficient evidence for defensive action. Organizations should add the domain and its IPv6 address to deny‑list configurations, monitor Cloudflare‑originated traffic for re‑registration attempts, and ensure that URL filtering solutions ingest the observed indicators. Continuous vigilance is advised, as the infrastructure—namely Cloudflare’s shared network—could be reused for future phishing campaigns.