snhgj63lowi-xvtly103nhb-3a7c8f-ltp91p[.]pages[.]dev

This domain, snhgj63lowi-xvtly103nhb-3a7c8f-ltp91p.pages.dev, is currently flagged as an active generic phishing site. Infrastructure analysis shows the hostname is served via Cloudflare Pages, a static‑site hosting service that places the site behind Cloudflare’s reverse‑proxy network. Consequently the origin IP is hidden and the public address resolves to a Cloudflare edge node that presents a valid TLS certificate issued to *.pages.dev. The domain appears on a single external blocklist and is listed by PhishDestroy as malicious, confirming that at least one security operator has observed abusive activity. VirusTotal reports that seven of ninety‑one scanning engines have generated a detection for the domain, which aligns with the blocklist entry and suggests that automated scanners have identified phishing‑related characteristics, although the majority of engines have not flagged it.

Publicly available metadata does not include a page title, brand target, or detailed content snapshot, so the exact landing page content remains unknown. The lack of additional intelligence such as observed credential‑harvesting URLs or associated malware limits the ability to attribute a specific phishing campaign or victim profile. However, the combination of Cloudflare Pages hosting, blocklist presence, and multiple vendor detections provides sufficient confidence to treat the domain as hostile.

Defenders should incorporate the hostname into URL filtering rules, block it at perimeter firewalls, and add it to host‑based deny lists. Continuous monitoring of Cloudflare‑issued TLS certificates for this sub‑domain is advisable, as changes may indicate a shift in hosting strategy. Organizations using phishing‑prevention tools should ensure the domain is included in their threat‑intel feeds, and incident response teams should treat any credential submissions to this address as potentially compromised.