blpqr2e71kq-wjnhfplos-0c7d9a-lxp53w[.]pages[.]dev

Analysis conducted on August 04, 2026 identifies the domain blpqr2e71kq-wjnhfplos-0c7d9a-lxp53w.pages.dev as an active generic phishing infrastructure. The domain is hosted on Cloudflare Pages, indicating the use of Cloudflare’s static‑site hosting service and its associated edge network. VirusTotal reports that eight of ninety‑one scanned security vendors have generated a detection for the domain, confirming that a subset of commercial scanners consider it malicious. The domain is currently listed on one public security blocklist and has been explicitly blocked by the PhishDestroy threat‑intelligence feed, reinforcing its classification as a phishing resource.

The Cloudflare Pages registration obscures the registrant’s identity, a common tactic for rapid deployment of phishing sites. The available intelligence does not disclose the underlying IP address, SSL certificate details, or HTTP response codes, and no page title or brand targeting information has been published. Consequently, the precise content and luring technique employed by the site remain unverified, and analysts cannot confirm whether credential‑harvesting pages or other payloads are present. The limited blocklist presence suggests the domain is relatively new, which aligns with the elevated risk assignment.

Defenders should continue to deny any network traffic to this host, incorporate the domain into DNS‑based deny lists, and ensure that endpoint protection solutions are updated to reflect the eight vendor detections. Monitoring for any future appearance of the domain on additional blocklists or an increase in detection counts is advisable, as such changes could indicate a scaling of the phishing campaign. Given the elevated risk rating and the active status, organizations are recommended to treat the domain as malicious and block it at perimeter and endpoint layers.