hxdi-o4g3u-j6c5m-uf4th4-1n3[.]pages[.]dev

This domain, hxdi-o4g3u-j6c5m-uf4th4-1n3.pages.dev, is actively impersonating Cloudflare infrastructure as of July 19, 2026. Registered through Cloudflare Pages, the domain resolves to IP 188.114.96.3, an address associated with Cloudflare, Inc. in Canada. The page title, 'Suspected Malware | Cloudflare,' explicitly references the targeted brand, indicating an attempt to deceive users into believing the site is legitimate Cloudflare content. Analysis reveals a 403 HTTP status, suggesting access restrictions or defensive measures, while the SSL certificate is issued by Google Trust Services (WE1). The domain appears on one security blocklist, and 12 of 91 security vendors on VirusTotal have flagged it as malicious. No further details about the exact nature of the payload or user interaction are available at this time. Defenders should treat this domain as high-risk brand impersonation, block it at the DNS or proxy level, and monitor for connections from internal assets. The domain remains active, and further investigation into its hosting behavior and potential distribution channels is recommended.