wldsf42skrp-zbkpthb-0c3f8d-wlq87c[.]pages[.]dev

Analysis of wldsf42skrp-zbkpthb-0c3f8d-wlq87c.pages.dev indicates that the domain is actively being used for a generic phishing operation as of the report date, August 04, 2026. The domain is listed on two public security blocklists and is explicitly blocked by the PhishDestroy and OpenPhish feed providers. VirusTotal has recorded detections from 11 of 91 scanned security vendors, confirming that a subset of anti‑malware engines consider the host malicious. The threat is classified with an elevated risk level and remains active in the intelligence feed.

Infrastructure observations show the domain resolves under the pages.dev sub‑domain, a hosting namespace commonly associated with cloud‑based static site services. No additional IP or autonomous system details were supplied in the available intelligence, and SSL/TLS information was not disclosed, limiting further network‑level attribution. The page title and any brand impersonation have not been released, so the precise visual content of the site cannot be confirmed at this time. Defenders should treat the domain as a confirmed phishing source.

Immediate mitigation steps include adding the domain to local and network‑level blocklists, ensuring that any security solutions ingest the PhishDestroy and OpenPhish feeds, and configuring URL filtering to deny traffic to pages.dev sub‑domains that appear on blocklists. Continuous monitoring of VirusTotal and other multi‑engine scanners for changes in detection counts is recommended, as additional vendor detections may surface. Because the underlying hosting provider may host both legitimate and malicious content, broader blocking of the entire pages.dev namespace should be considered only after assessing impact on legitimate services. Incident response teams should also review any logs for recent connections to this domain to identify potential compromise attempts.