twt-dkptfz5p[.]pages[.]dev

The domain twt-dkptfz5p.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the IP address 172.66.47.95, which belongs to Cloudflare’s AS13335 network in the United States. The site was observed with the page title “Get Your Rewards!” and did not present an SSL certificate at the time of analysis. It has been taken offline, and its current HTTP status is unavailable.

Threat intelligence sources indicate that the domain appears on a single security blocklist and is actively blocked by the PhishDestroy service. VirusTotal records show that the domain was scanned by 93 antivirus and URL‑reputation vendors, none of which reported a detection; this absence of detections does not constitute confirmation of safety. The lack of TLS encryption, combined with the reward‑oriented page title, aligns with typical generic phishing patterns that lure victims into providing credentials or personal data.

Because the infrastructure is hosted behind Cloudflare, attribution of the underlying server is obscured, and the exact payload or credential‑harvesting mechanism remains unknown. Defenders should continue to monitor the IP address 172.66.47.95 for any re‑activation, enforce blocklist rules for the domain, and consider adding the host to internal URL filtering policies. Network traffic to this domain should be logged and examined for potential credential submissions, and any related indicators of compromise should be shared with broader threat‑sharing communities to aid in rapid detection of repeat use.