msprq8c60qt-vnzktnnx-0b9c3d-vn800a[.]pages[.]dev

On August 07, 2026, the domain msprq8c60qt-vnzktnnx-0b9c3d-vn800a.pages.dev was observed hosting a generic phishing infrastructure. The domain resolves to the IPv4 address 172.66.47.178, which is owned by Cloudflare and is typical for sites deployed on Cloudflare Pages. Registration metadata indicates the site was provisioned through the Cloudflare Pages service, confirming the use of a legitimate hosting provider to obscure abusive activity. The domain appears on two reputable blocklists, PhishDestroy and OpenPhish, and has been actively blocked by those services.

VirusTotal analysis shows that 11 of 91 scanned security vendors flagged the domain as malicious, reinforcing the suspicion that the site is being used for credential‑stealing or other fraudulent purposes. No public page title, brand target, or malicious kit information is currently available, leaving the exact impersonated brand or scam template unknown. The lack of visible page content limits attribution but the combined evidence—blocklist listings, multiple vendor detections, and hosting on a high‑reputation CDN—indicates a credible threat.

Defenders should add the domain to internal deny‑list rules, monitor DNS queries for the IP 172.66.47.178, and enforce web‑proxy filtering that references the known blocklists. Incident responders should treat any user‑initiated connections to the domain as suspicious and advise users to avoid providing credentials or personal data. Continuous monitoring of VirusTotal and other threat‑intelligence feeds is recommended to capture any changes in detection scores or additional intelligence that may reveal the targeted brand or payload details.