dravemi-gld-zorquni-r4x1hq97[.]pages[.]dev

The domain dravemi-gld-zorquni-r4x1hq97.pages.dev is currently active and classified as a high‑risk generic phishing site. Infrastructure analysis shows the domain is hosted on Cloudflare Pages and resolves to the IP address 188.114.96.3. Reputation services flag the domain: sixteen out of ninety‑one security vendors on VirusTotal have issued detections, and Google Safe Browsing lists it for social engineering.

Independent blocklists confirm the threat, with PhishDestroy actively blocking the domain and one additional security blocklist enumerating it as malicious. The registration pathway through Cloudflare Pages suggests the attacker leveraged a widely trusted CDN to obscure the true origin of the content and to benefit from Cloudflare’s built‑in DDoS protection. No public page title, SSL certificate details, or content snapshot are available, so the exact lure or credential‑capture mechanism remains unverified.

Defenders should prioritize immediate blocking of the domain at perimeter firewalls, DNS resolvers, and proxy filters. Continuous monitoring of DNS queries for the associated IP and the use of threat‑intel feeds that reference the domain can help surface any downstream infrastructure expansions. Incident responders should also consider sinkholing traffic to the IP to gather additional telemetry while preventing end‑user exposure.