msprq72kfly-ycgfnpdr-0e5a1b-vn555c124[.]pages[.]dev

The domain msprq72kfly-ycgfnpdr-0e5a1b-vn555c124.pages.dev was observed on August 06, 2026 as part of an active generic phishing campaign. VirusTotal records indicate that the domain has been submitted to 91 scanning vendors, none of which returned a detection at the time of analysis. While the absence of detections does not constitute assurance of benign behavior, it confirms that no known signatures have yet flagged the site. The domain appears on a single security blocklist and is explicitly blocked by the PhishDestroy feed, demonstrating that at least one reputable anti‑phishing source has identified it as malicious.

DNS resolution points to the IP address 172.66.44.147; the hosting environment associated with this address has not been publicly attributed to a specific provider in the available data, and no SSL certificate details, HTTP status codes, or page title information have been published. Consequently, the content served by the domain remains unverified, and the exact phishing lure or target brand cannot be confirmed. Defenders should treat the domain as high‑risk until further forensic evidence is obtained.

Recommended mitigations include adding the domain and its resolving IP to inbound and outbound blocklists, monitoring DNS queries for repeated resolution to 172.66.44.147, and employing URL filtering solutions that reference the PhishDestroy blocklist. Continuous re‑scanning with multi‑vendor services is advised to capture any future detection updates. Organizations should also consider threat‑intel sharing to propagate observations of related infrastructure, as the limited data set suggests a low‑profile deployment that may evolve to target additional victims.