thexdexva[.]pages[.]dev

Analysis of thexdexva.pages.dev indicates that the domain was registered through Cloudflare, Inc. on February 21, 2026 and is hosted on Cloudflare’s network (AS13335) with the IP address 172.66.45.34 located in the United States. The site presented the page title “Suspected phishing site | Cloudflare” and is classified as a credential phishing operation. Technical fingerprints show the use of HSTS, Cloudflare services, and HTTP/3, and the TLS certificate is issued by Google Trust Services under the WE1 designation. VirusTotal scans returned 15 positive detections out of 93 security vendors, and the domain is listed on at least one public blocklist, including PhishDestroy.

The HTTP response observed was 403, and the site has since been taken offline, as reflected by its current status. Reputation services assign extremely low trust scores, with Scamadviser rating the domain 1/100 and Gridinsoft 0/100. Nameservers are dee.ns.cloudflare.com and rodney.ns.cloudflare.com.

The available evidence confirms the domain’s use for credential harvesting, but the specific target brand or the exact phishing page content has not been disclosed. Defenders should continue to block the domain at the DNS and proxy layers, monitor for any resurgence of the same IP or nameserver configuration, and consider adding the IP address 172.66.45.34 to threat‑intel feeds. Ongoing observation of Cloudflare‑hosted infrastructure associated with this domain is recommended, as threat actors may reuse the same hosting assets for future campaigns.