qvkwmdjmz[.]pages[.]dev

Analysis conducted on July 23, 2026 identifies qvkwmdjmz.pages.dev as a confirmed phishing infrastructure. The domain was created on February 21, 2026 and registered through Cloudflare, Inc. DNS resolution points to the address 172.66.46.222, an IP owned by AS13335 Cloudflare, Inc. located in the United States. No TLS certificate is presented, indicating the site operated without HTTPS. The HTTP response includes the page title “Suspected phishing site | Cloudflare”. VirusTotal records show 14 detections out of 93 scanning engines, confirming that multiple security vendors have flagged the domain as malicious.

It appears on a single public security blocklist and is actively blocked by PhishDestroy. The infrastructure is fully hosted on Cloudflare’s edge network, a pattern commonly observed for disposable phishing sites that exploit rapid provisioning and built‑in DDoS mitigation. The current status is offline, suggesting the site has been taken down, either by the operators or through takedown actions. Despite the offline state, the recent registration date and the vendor detections imply the domain was used shortly after creation for phishing activity.

Details about the specific phishing campaign, target brands, or credential‑harvesting mechanisms remain unknown because page content has not been captured. Defenders should continue to monitor the domain and its associated IP for any reappearance, add the IP 172.66.46.222 and the domain to inbound and outbound proxy blocklists, and share detection details with threat‑intel sharing platforms. Organizations employing URL filtering should ensure the domain is included in block policies, and security teams should audit logs for recent connections to the IP prior to takedown. Ongoing vigilance is recommended given the demonstrated use of Cloudflare‑hosted domains for rapid phishing deployments.