p-1px[.]pages[.]dev

The domain p-1px.pages.dev was observed on July 24, 2026. It was created on 21 February 2026 and is registered through Cloudflare, Inc., using the Cloudflare nameservers rafe.ns.cloudflare.com and merlin.ns.cloudflare.com. DNS resolution returns the IPv6 address 2606:4700:310c::ac42:2c59, which belongs to AS13335 Cloudflare, Inc. and is geolocated to the United States. The site serves an HTTPS endpoint secured by a Google Trust Services certificate (WE1) and implements HTTP Strict Transport Security, Cloudflare’s edge services, and HTTP/3. Public blocklists have listed the domain on PhishDestroy, ScamSniffer, and Enkrypt.

Security‑vendor aggregators report eight detections out of ninety‑three scanners, and the domain appears on three separate phishing blocklists. Independent reputation services assign very low scores: Gridinsoft rates it 0 / 100 and Scamadviser 11 / 100, indicating a high likelihood of malicious intent. The page title returned by the server is “Suspected phishing site | Cloudflare,” and the HTTP response code is 403, suggesting that the content is currently inaccessible because the site has been taken offline. The classification from the intelligence feed identifies the activity as credential phishing, though the specific target brand or service is not disclosed in the available data. No additional artifacts such as payload hashes, phishing kits, or malicious URLs were captured.

Because the domain is hosted behind Cloudflare’s CDN, direct attribution of the underlying infrastructure is limited. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑registration, and add the IPv6 address to deny lists. Threat‑intel teams should track changes in the blocklist status and re‑query VirusTotal or similar scanners if the domain resurfaces. Automated URL filtering should flag any future requests to p-1px.pages.