campus-cdmx-amerike[.]pages[.]dev

Analysis indicates that the domain campus-cdmx-amerike.pages.dev was registered on June 09, 2026 via the Cloudflare Pages service. The domain resolves to the IP address 172.66.47.121, which belongs to Cloudflare’s edge network. VirusTotal has recorded two positive detections out of ninety‑one submitted scanners, indicating that a minority of security engines have identified malicious behavior associated with the host. The domain is listed on a single external blocklist and is actively blocked by the PhishDestroy feed, confirming that at least one reputable anti‑phishing repository considers it malicious.

No additional intelligence such as SSL certificate details, HTTP response codes, page title, or safe‑browsing verdicts has been provided, leaving the content and exact phishing lure unknown. The limited detection footprint suggests that the campaign may be in an early stage or employing a low‑profile hosting configuration to avoid broader exposure. Defenders should prioritize adding the domain and its resolving IP to network‑level deny lists and ensure that web‑proxy or DNS filtering solutions reference the PhishDestroy feed.

Continuous monitoring of Cloudflare Pages registrations for similarly patterned subdomains can help uncover future variants. Given the recent creation date, the infrastructure is likely still being provisioned; therefore, threat‑intel teams should track any future VirusTotal submissions or blocklist additions that increase the detection count. Until further evidence emerges, treating the domain as malicious and preventing user access is the recommended mitigation.