texchvaganzk[.]pages[.]dev

The domain texchvaganzk.pages.dev was observed serving a page with the title “Suspected phishing site | Cloudflare”. The site is registered through Cloudflare, Inc., and the domain was created on 21 February 2026. DNS resolution points to the IP address 172.66.47.158, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The TLS certificate presented is issued by Google Trust Services under the WE1 root, indicating a valid HTTPS endpoint, but the HTTP response code returned is 403, and the current operational status is reported as offline. Security telemetry classifies the site as a credential phishing operation.

The Gridinsoft trust score for the domain is 0 out of 100, and Scamadviser assigns a trust rating of 11 out of 100, both indicating a high likelihood of malicious intent. The domain appears on three independent blocklists: PhishDestroy, ScamSniffer, and Enkrypt, confirming that multiple anti‑phishing feeds have flagged it. VirusTotal analysis shows that six of ninety‑three scanning engines flagged the domain, further corroborating suspicious behavior. Technologically the host advertises HTTP/3, HSTS, and Cloudflare‑provided services. Nameserver records are kay.ns.cloudflare.com and porter.ns.cloudflare.com, consistent with the registrar’s infrastructure.

No additional intelligence such as malware families, C2 infrastructure, or victim targeting has been disclosed, leaving the exact phishing payload and lure unknown. Defenders encountering traffic to texchvaganzk.pages.dev should block the domain at perimeter filters, add it to internal deny lists, and monitor for any credential submission attempts that may have been directed to this host before its offline status. Continuous re‑evaluation is advised in case the domain becomes re‑hosted or the underlying IP is reused for other malicious campaigns.