cuevana3-udf0[.]pages[.]dev

Analysis of cuevana3-udf0.pages.dev confirms its classification as a credential phishing site targeting users of streaming services. The domain, registered on February 21, 2026, through Cloudflare, Inc., resolves to 172.66.45.35, hosted on Cloudflare's infrastructure (AS13335). The page title, 'Cuevana3: Cine y Series Gratis (Guía Oficial 2025)', explicitly mimics a popular streaming platform, aligning with the credential phishing classification. Google Safe Browsing has flagged the domain for social engineering, and Gridinsoft assigns a trust score of 0/100, indicating high risk. Seven of 93 security vendors on VirusTotal detect the domain as malicious, though the specific signatures or payloads remain unconfirmed.

The domain is currently offline, returning an HTTP 403 status, and appears on at least one security blocklist, including PhishDestroy. Infrastructure analysis reveals the use of Cloudflare nameservers (paige.ns.cloudflare.com, wesley.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1), which is consistent with legitimate sites but does not mitigate the phishing risk. Technologies detected include HSTS and HTTP/3, suggesting an attempt to appear modern and secure. The domain's registration details and hosting provider offer no additional attribution, as Cloudflare is commonly used for both legitimate and malicious purposes.

Defenders should treat this domain as a confirmed phishing threat, particularly for users seeking free streaming services. Blocking the domain at the DNS or proxy level is recommended, along with monitoring for related domains using similar naming conventions or Cloudflare Pages infrastructure. While the site is offline, historical or cached versions may still pose a risk, and users should be alerted to the credential phishing tactics implied by the page title. Further analysis of the phishing kit or payload, if recovered, could provide additional indicators of compromise.