zylen-hold[.]pages[.]dev

Analysis of zylen-hold.pages.dev shows that the domain was registered on 21 February 2026 through Cloudflare, Inc. and is currently taken offline. The authoritative nameservers are kallie.ns.cloudflare.com and suullivan.ns.cloudflare.com, indicating that the domain relies on Cloudflare’s DNS and proxy services. DNS resolution points to the IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc., located in the United States. The site presented a Cloudflare‑issued SSL certificate signed by Google Trust Services (WE1), and the HTTPS handshake succeeded, but HTTP requests return a 403 status code and the page title reads "Suspected phishing site | Cloudflare".

VirusTotal has recorded 15 positive detections out of 93 scanned security vendors, and the domain is listed on at least one public blocklist. PhishDestroy has already blocked the domain, and the Gridinsoft trust score is 0 out of 100, while Scamadviser assigns a trust rating of 1 out of 100, both indicating a high likelihood of malicious intent. The only identified scam type is credential phishing, and the site employs standard Cloudflare security technologies such as HSTS and HTTP/3. No additional infrastructure details such as backend servers, content delivery networks beyond Cloudflare, or malicious payloads have been observed.

Because the domain is already offline, immediate mitigation consists of ensuring that internal DNS filters and security gateways continue to block the IP 188.114.96.3 and the domain name. Organizations should update their threat intelligence feeds with the observed indicators – domain name, registration date, IP address, ASN, SSL certificate information, and detection counts – to prevent future attempts that reuse the same hosting configuration. Continuous monitoring of Cloudflare‑registered domains that share similar naming patterns is recommended, as the registrar can be abused to spin up short‑lived phishing sites.