pawfury-com[.]pages[.]dev

Analysis of pawfury-com.pages.dev shows a newly created domain (registered 06 March 2026) that has been taken offline but exhibits multiple high‑confidence malicious indicators. The domain is registered through Cloudflare, Inc. and uses Cloudflare authoritative nameservers jessica.ns.cloudflare.com and ken.ns.cloudflare.com. DNS resolution points to IP 172.66.44.52, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. An HTTPS request returns a 403 status code and the page title "Suspected phishing site | Cloudflare," indicating that Cloudflare has flagged the site as a phishing target.

The SSL certificate is issued by Google Trust Services under the WE1 trust anchor, confirming the use of a legitimate certificate chain despite the malicious intent. Google Safe Browsing classifies the domain as social engineering, and VirusTotal records nine detections out of ninety‑four scanning engines, reinforcing the malicious assessment. The domain appears on three external blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, demonstrating consensus among threat‑intel feeds. Gridinsoft assigns a trust score of 0/100, the lowest possible rating, underscoring the high‑risk posture.

While the exact phishing content or targeted brand is not disclosed, the convergence of registration, hosting, SSL, and detection data provides sufficient evidence for defensive action. Security teams should immediately add pawfury-com.pages.dev to DNS and URL blocklists, monitor outbound traffic for connections to 172.66.44.52, and incorporate the domain into SIEM correlation rules to alert on any attempted use. Continued observation of Cloudflare’s takedown page is advisable for potential re‑hosting attempts, but current indicators justify a high‑risk classification and proactive mitigation.