euhkskjvietkoreeark-kgudopnfnldcoqskgbjsfccb[.]pages[.]dev

The domain euhkskjvietkoreeark-kgudopnfnldcoqskgbjsfccb.pages.dev was registered on 11 March 2026 through Cloudflare, Inc. It resolves to the Cloudflare edge address 172.66.45.35, which is announced by AS13335 and geolocated to the United States. DNS resolution is served by the Cloudflare authoritative nameservers jade.ns.cloudflare.com and lee.ns.cloudflare.com. An HTTPS certificate issued by Let’s Encrypt (E8 identifier) is present, confirming that TLS termination is also handled by Cloudflare. When accessed, the site returns HTTP 403, indicating that the content is currently inaccessible. The page title returned by the server is "Suspected phishing site | Cloudflare," which aligns with the generic phishing classification assigned by analysts.

VirusTotal has recorded 14 positive detections out of 94 scanned security vendors, reinforcing the malicious assessment. The domain appears on a single public blocklist and has been specifically listed by PhishDestroy, confirming that external threat‑intelligence feeds have flagged it. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, suggesting an extremely low confidence in the site’s legitimacy. The current operational status is marked as offline, and no additional content or functional analysis is available.

The evidence base therefore confirms a Cloudflare‑hosted phishing infrastructure that has already been identified by multiple vendors. What remains uncertain are the exact payload or credential‑harvesting mechanisms, the target audience, and any associated command‑and‑control infrastructure, as no further forensic artefacts have been disclosed. Defenders should block the domain at the DNS layer, add 172.66.45.35 to host‑based deny lists, and monitor for any outbound connections to Cloudflare edge nodes that may be used for future phishing campaigns.