secured-prompt[.]pages[.]dev

secured-prompt.pages.dev was registered on April 11 2026 through the Cloudflare Pages service. The domain resolves to the IP address 172.66.46.227, which is owned by Cloudflare and therefore inherits the provider’s extensive CDN network and any associated anonymity benefits. No additional hosting details are disclosed beyond the Cloudflare association. Public threat intelligence indicates that the domain is currently listed on a single security blocklist, specifically PhishDestroy, which classifies it as a credential‑phishing resource.

VirusTotal analysis shows that 11 of 91 scanned security vendors have flagged the domain as malicious, suggesting a moderate consensus among scanners that the site is being used for phishing. The presence on PhishDestroy and the multi‑vendor detections provide corroborating evidence of malicious intent. The elevated risk rating reflects the combination of recent creation, use of a reputable hosting platform, and active detection by multiple vendors. However, the limited blocklist coverage (only one list) and the fact that the majority of VirusTotal scanners have not raised an alert leave uncertainty regarding the scale of the campaign, the specific credential‑capture mechanisms employed, and the target audience.

No public page title, SSL certificate details, or additional intelligence such as OTX identifiers are available at this time. Defenders should block or sinkhole the resolved IP 172.66.46.227 and add secured-prompt.pages.dev to URL filtering rules for credential‑phishing categories. Continuous monitoring of Cloudflare‑hosted subdomains is recommended, as the provider’s dynamic allocation can allow rapid redeployment of malicious pages. Organizations should also enforce multi‑factor authentication and educate users about unsolicited login requests, especially those that may originate from newly created domains hosted on popular CDN services.