podslushano-tme31185[.]pages[.]dev

Analysis indicates that the domain podslushano-tme31185.pages.dev was registered on 21 February 2026 through Cloudflare, Inc. The domain resolves to the IP address 188.114.96.3, which is attributed to Cloudflare, Inc. and geolocated to Canada. DNS resolution uses the Cloudflare authoritative nameservers nash.ns.cloudflare.com and celine.ns.cloudflare.com. The site presents an SSL certificate identified as WE1 and enforces HTTP Strict Transport Security (HSTS) while supporting HTTP/3, confirming the use of Cloudflare's edge services. An HTTP request to the host returns a 403 status code, indicating that the resource is presently inaccessible. The page title returned by the server is “golos-deti20.ru”, a Russian‑language phrase that may hint at the intended victim set, although no further content has been captured.

Security telemetry shows the domain is listed on one blocklist and has been blocked by the PhishDestroy service. The Gridinsoft trust score is 0 / 100, reflecting a maximal risk assessment. VirusTotal analysis recorded detections from two of ninety‑three scanning engines, reinforcing the malicious classification. The overall threat type is credential phishing, targeting the capture of user credentials.

Because the infrastructure relies on Cloudflare’s shared IP space, direct blocking of the IP may affect legitimate services; instead, defenders should enforce domain‑level blocking in DNS filtering solutions and monitor the associated IP for any resurgence of malicious activity. Continuous re‑query of the domain’s DNS records is recommended to detect potential re‑hosting or changes in the certificate. Email gateways should be tuned to flag any messages referencing the “golos‑deti20.ru” title or containing links to the pages.dev subdomain. Although the site is currently offline, the observed indicators suggest a functional phishing campaign that could be re‑activated, and proactive defensive measures are advised.