craxs-rat[.]pages[.]dev

Analysis indicates that the domain craxs-rat.pages.dev was provisioned on February 21, 2026 through Cloudflare, Inc. The authoritative name servers are desiree.ns.cloudflare.com and kaiser.ns.cloudflare.com, both belonging to Cloudflare’s DNS service. DNS resolution points to IP address 172.66.47.132, which is announced by AS13335 Cloudflare, Inc. and geolocated to the United States. An HTTPS handshake presents a certificate issued by Google Trust Services under the WE1 trust hierarchy, confirming the use of a valid TLS certificate. HTTP requests receive a 200 OK status and the page title returned is “Suspected phishing site | Cloudflare”, indicating that the site was flagged by Cloudflare’s own detection mechanisms.

The service is observed to employ HSTS, HTTP/3, and other Cloudflare‑provided security technologies. Threat intelligence aggregators have recorded ten positive detections out of ninety‑three vendors on VirusTotal, and the domain is listed on a single external blocklist managed by PhishDestroy. The Gridinsoft trust score for the domain is 0 out of 100, reinforcing the malicious assessment. No additional content analysis is available because the site has been taken offline at the time of reporting.

Defenders should treat the domain as malicious and ensure that network‑level controls block any outbound connections to the IP 172.66.47.132 and to the host name craxs-rat.pages.dev. Email security gateways should incorporate the domain into URL reputation lists, and endpoint detection solutions should flag any process that attempts to resolve or contact the domain. Continuous monitoring of newly created subdomains under the pages.dev namespace, especially those registered through Cloudflare, is recommended to capture potential re‑use of similar infrastructure. The combination of a recent registration date, Cloudflare hosting, a valid TLS certificate, and multiple vendor detections suggests a deliberate phishing operation, despite the current offline status.