97a0bd1f[.]ajkevmslay[.]pages[.]dev

This domain is flagged as an active credential harvesting phishing site with an elevated risk level. Analysis indicates it is designed to capture user credentials through fraudulent login interfaces, a common tactic in targeted phishing campaigns. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Cloudflare, Inc. and resolves to IP address 188.114.96.3, hosted on AS13335 in the United States. The domain lacks an SSL certificate and is currently blocked by one security blocklist. VirusTotal reports 12 out of 95 security vendors detecting the domain as malicious, while the page title explicitly states 'Suspected phishing site | Cloudflare,' further corroborating its fraudulent nature. Mitigation requires immediate blocking of the domain and its resolving IP (188.114.96.3) at the network perimeter. Security teams should monitor for connections to this domain in proxy logs and endpoint telemetry, particularly from users who may have interacted with phishing emails or messages. Credential resets should be enforced for any accounts that accessed the domain, and multi-factor authentication should be mandated for all critical systems to mitigate the impact of potential credential theft.