us-login--ndex[.]pages[.]dev

us-login--ndex.pages.dev is currently listed as offline and returns HTTP 403. The site presents the page title “Suspected phishing site | Cloudflare”, indicating that the hosting provider’s default error page is being used. The domain was created on 21 February 2026 and is registered through Cloudflare, Inc., with authoritative nameservers greg.ns.cloudflare.com and serenity.ns.cloudflare.com. DNS resolution points to IP 172.66.47.54, which belongs to AS13335 Cloudflare, Inc., located in the United States. The TLS certificate is issued by Google Trust Services under the WE1 label, confirming the use of a valid certificate despite the malicious intent.

Infrastructure analysis shows the presence of HSTS, Cloudflare services, and HTTP/3 support, confirming that the attacker leveraged modern Cloudflare features to obscure origin infrastructure. Reputation checks reveal that the domain is flagged by ten of ninety‑three VirusTotal scanners, appears on a single security blocklist, and is blocked by the PhishDestroy service. Google Safe Browsing categorises the site as social engineering, and Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the high‑risk assessment. The threat type is identified as credential phishing, and the risk level is marked as high. While the page content has not been captured, the available indicators are sufficient for defenders to take immediate action.

Security teams should add the domain and its IP address to local blocklists, enforce URL filtering, and monitor for any outbound connections to the Cloudflare‑hosted IP. Incident response playbooks should treat any credential submissions to this domain as compromised, and affected users should be prompted to reset passwords. Continuous monitoring of the Cloudflare nameserver space is advised, as the attacker may generate additional sub‑domains using the same registration profile.