592cc92d[.]race-bxj[.]pages[.]dev

Analysis of 592cc92d.race-bxj.pages.dev shows a high‑risk credential phishing infrastructure that was taken offline as of the report date, July 23, 2026. The domain was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the Cloudflare edge address 172.66.44.145, which is located in the United States under ASN AS13335 (Cloudflare, Inc.). The site presents a page titled "Suspected phishing site | Cloudflare" and returns an HTTP 403 status code, indicating that the content is inaccessible to the public. The TLS certificate is issued by Google Trust Services under the WE1 label, and the site employs HSTS and HTTP/3, confirming modern Cloudflare delivery.

Reputation metrics are extremely poor: Gridinsoft assigns a trust score of 0/100, Scamadviser rates the domain at 45/100, and the domain appears on one security blocklist. PhishDestroy has already blocked the domain, and Google Safe Browsing flags it for social engineering. VirusTotal analysis reports that 11 of 93 security vendors have flagged the domain, reinforcing the malicious classification.

The available evidence points to a credential‑phishing campaign, but the specific target brand and the exact payload or credential collection mechanisms remain unknown because the page content could not be retrieved. Defenders should continue to block the domain at DNS and proxy layers, add the associated IP address to deny lists, and monitor for any re‑registration of the domain or similar sub‑domains under the same registrar. Ongoing surveillance of Cloudflare‑hosted assets and rapid sharing of any new indicators of compromise are recommended to mitigate potential re‑use of this infrastructure.