wjsng83-kxztp104vzk-9c2d1f-mvr28[.]pages[.]dev

This domain, wjsng83-kxztp104vzk-9c2d1f-mvr28.pages.dev, is actively flagged as a credential phishing site by multiple security vendors and blocklists as of August 7, 2026. Analysis indicates an elevated risk level due to its presence on two security blocklists, including PhishDestroy and OpenPhish, which specialize in real-time phishing detection. Infrastructure analysis reveals the domain resolves to IP address 172.66.46.218, an address associated with Cloudflare's content delivery network, commonly exploited by threat actors to mask hosting origins and evade takedowns.

VirusTotal reports 15 of 91 security vendors marking this domain as malicious, though the exact nature of the phishing content remains unconfirmed due to limited metadata. No registrar or ASN details are currently available, and the domain appears to use Cloudflare Pages, a platform frequently abused for rapid deployment of phishing kits. The absence of additional context, such as SSL certificate anomalies or HTTP response irregularities, suggests the domain may rely on social engineering rather than technical exploits.

Defenders should treat this domain as high-risk and implement immediate blocking at the network and endpoint levels. Further investigation into connected infrastructure, such as subdomains or linked IPs, is recommended to identify broader campaign patterns. Given the domain's active status and detection by specialized anti-phishing tools, organizations are advised to monitor for credential harvesting attempts originating from this source.