customer-refund[.]pages[.]dev

The domain customer-refund.pages.dev was registered on 21 February 2026 via Cloudflare, Inc. and resolves to the IP address 172.66.44.130, which belongs to Cloudflare’s AS13335 network located in the United States. No TLS certificate is presented, indicating that the site does not serve HTTPS traffic. VirusTotal scans have returned nine positive detections out of ninety‑three submitted security vendors, confirming that multiple engines consider the domain malicious.

The domain is listed on four public blocklists and is actively blocked by the phishing‑specific filters PhishDestroy, MetaMask, ScamSniffer, and SEAL. All observed indicators point to a generic phishing operation, and the site is currently taken offline, preventing live content analysis. The lack of an SSL certificate, combined with the presence on multiple blocklists and the VirusTotal detections, provides strong evidence that the domain was used for credential‑stealing or fraudulent activity.

Because the site is offline, the exact payload, landing page structure, or targeted brand cannot be verified at this time. Defenders should continue to deny any network traffic to 172.66.44.130, add customer-refund.pages.dev to DNS and URL filtering policies, and monitor for re‑registration or similar sub‑domains under the pages.dev suffix. Ongoing threat‑intel feeds should be consulted for any future sightings, and any user reports of unsolicited emails referencing “customer‑refund” should be treated as suspicious.