tuesdayfirst[.]pages[.]dev

Analysis of tuesdayfirst.pages.dev indicates that the domain was registered on March 01, 2026 and is currently taken offline, as confirmed by the blocklist entry from PhishDestroy. The site presented the page title "Webmail Login | IONOS by 1&1," which aligns with the classified scam type of brand impersonation targeting the IONOS webmail service. Infrastructure inspection shows the domain resolves to the IP address 188.114.96.3, hosted within the United States under ASN 13335 (Cloudflare, Inc.). The domain is served through Cloudflare's network, employing HSTS and HTTP/3, and utilizes a Google Trust Services / WE1 SSL certificate, suggesting a valid TLS configuration despite malicious intent.

DNS records list four Cloudflare nameservers (adi.ns.cloudflare.com, damon.ns.cloudflare.com, karl.ns.cloudflare.com, wally.ns.cl). An HTTP request to the host returns a 404 status, indicating the landing page is no longer accessible, which is consistent with the offline status. VirusTotal analysis recorded 16 detections out of 93 security vendors, reinforcing the malicious classification. The domain appears on a single external security blocklist, further confirming its threat profile.

While the page content cannot be examined directly, the combination of brand‑specific page title, registered hosting details, and multiple vendor detections provides sufficient evidence for defensive actions. Security teams should continue to block the domain at perimeter devices, update URL filtering lists, and consider sinkholing the associated IP range to prevent accidental resolution. Continuous monitoring of Cloudflare‑registered sub‑domains and related IP addresses is advised, as threat actors frequently recycle infrastructure. The limited public visibility of the site underscores the importance of proactive threat‑intel sharing to mitigate similar brand‑impersonation campaigns.