pacmonn[.]pages[.]dev

Analysis of pacmonn.pages.dev shows a high‑risk credential phishing infrastructure that was taken offline prior to the report date of July 23, 2026. The domain was registered on February 21, 2026 through Cloudflare, Inc., and resolves to the Cloudflare address 172.66.47.198, which is advertised as being located in the United States and belonging to AS13335 (Cloudflare, Inc.). DNS resolution uses the Cloudflare nameservers rayden.ns.cloudflare.com and paislee.ns.cloudflare.com. The site presented the Cloudflare‑generated page title "Suspected phishing site | Cloudflare" and responded with HTTP status code 403, indicating that access was denied by the hosting provider.

TLS termination is provided by a Google Trust Services certificate issued under the WE1 authority, confirming the use of legitimate SSL infrastructure despite the malicious purpose. Reputation services assign extremely low trust scores: Scamadviser reports 1 / 100 and Gridinsoft 0 / 100. The domain appears on three independent blocklists—PhishDestroy, ScamSniffer, and Enkrypt—and is flagged by ten of ninety‑three VirusTotal scanners, reinforcing the malicious classification. Detected technologies include HTTP/3, HSTS, and Cloudflare edge services, which are typical for fast‑forwarded phishing sites.

While the exact credential‑stealing payload and targeted brands remain unverified, the evidence confirms a credential phishing campaign hosted on reputable infrastructure and actively blocked by security vendors. Defenders should continue to block the domain at perimeter firewalls, update URL filtering lists with the three noted blocklists, and monitor for any re‑registration attempts or related subdomains that might reuse the same Cloudflare account. Given the offline status, ongoing vigilance is required to detect potential resurrection or migration of the campaign to new assets.