mjhgfghjk[.]pages[.]dev

Analysis of mjhgfghjk.pages.dev, observed as offline on July 24, 2026, shows multiple indicators of malicious activity consistent with credential phishing. The site presented the page title "Suspected phishing site | Cloudflare" and was served over HTTPS using a Google Trust Services / WE1 certificate issued by Cloudflare, Inc. The domain resolves to IP address 188.114.97.3, an address owned by AS13335 Cloudflare, Inc. in the United States. DNS resolution is handled by the nameservers kimora.ns.cloudflare.com and cartman.ns.cloudflare.com, both belonging to Cloudflare's infrastructure. HTTP requests return a 403 status code, suggesting the content is no longer publicly reachable, and the site has been taken offline.

Google Safe Browsing classifies the URL as social engineering, and PhishDestroy has added the domain to its blocklist. VirusTotal reports that nine of ninety‑three security vendors flagged the domain, reinforcing the suspicion of malicious intent. Independent reputation services assign extremely low trust scores: Gridinsoft rates the domain 0 out of 100, and Scamadviser rates it 1 out of 100, while the domain appears on a single security blocklist. The site was registered on February 21, 2026 through Cloudflare, Inc., and the only visible technologies are HSTS, Cloudflare, and HTTP/3.

No additional content analysis is possible because the site is offline, leaving the exact phishing payload or target unknown. Defenders should block the domain at network perimeters, add it to internal threat intelligence feeds, and monitor the associated IP address for any future activation. Continuous observation of Cloudflare‑hosted IP ranges for similar patterns is recommended, as the infrastructure is commonly abused for fast‑flux hosting of phishing pages.