threshold-gay[.]pages[.]dev

The domain threshold-gay.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and is currently listed as offline. DNS resolution points to the IP address 172.66.44.108, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The domain is served behind Cloudflare’s edge network, as indicated by the presence of Cloudflare‑provided nameservers (ines.ns.cloudflare.com and wesley.ns.cloudflare.com) and the detection of HSTS, HTTP/3, and other Cloudflare technologies. An SSL certificate issued by Google Trust Services (WE1) secures the site, confirming the use of a legitimate certificate authority.

When accessed, the server returned an HTTP 403 status code, suggesting that the content is not publicly reachable, consistent with the reported offline status. VirusTotal analysis shows that four of ninety‑three security vendors flagged the domain, and the domain appears on a single security blocklist. PhishDestroy has also blocked the domain, and Gridinsoft assigns it a trust score of zero out of one hundred, reinforcing the assessment of malicious intent. The page title returned from the host is "Home - Threshold Records," which aligns with the generic phishing classification and indicates a possible attempt to masquerade as a legitimate record‑keeping or music‑related service.

While the exact credential‑phishing payload has not been observed, the combination of low trust scores, vendor detections, and blocklist presence confirms an elevated risk profile. Defenders should continue to block the domain at network perimeter devices, update URL filtering policies to include the observed IP and host, and monitor for any related indicators of compromise that reference the same Cloudflare infrastructure or SSL certificate. Additional investigation should focus on any login‑capture infrastructure that may have been associated with the domain before it was taken offline.