vertex-take[.]pages[.]dev

The domain vertex-take.pages.dev was registered through Cloudflare on 21 February 2026 and is currently listed as offline with an HTTP 403 response. The site presents the page title “Suspected phishing site | Cloudflare”, indicating that Cloudflare’s default block page is being served. Infrastructure analysis shows the domain resolves to IP 172.66.47.84, which belongs to AS13335 Cloudflare, Inc. and is located in the United States. The TLS certificate is issued by Google Trust Services under the WE1 root, confirming the use of a valid SSL chain.

Detected technologies include HSTS, Cloudflare’s reverse‑proxy services, and HTTP/3 support, suggesting the operator leveraged modern CDN features to hide origin infrastructure. VirusTotal has recorded 11 detections out of 95 scanned security vendors, reinforcing the classification of the domain as a credential‑phishing site. The Gridinsoft trust score is 0 / 100, and the domain appears on one external blocklist, currently blocked by PhishDestroy. Nameservers trace.ns.cloudflare.com and lucy.ns.cloudflare.com are the default Cloudflare resolvers.

The available evidence confirms that vertex‑take.pages.dev is being used for credential phishing, but the specific target brand or the exact phishing payload has not been disclosed in the collected data. Analysts should continue to monitor the domain for any re‑activation, enforce blocklists at perimeter defenses, and consider adding the IP address 172.66.47.84 to deny‑list rules. Because the SSL certificate is legitimate, content‑based detection may be required in addition to network‑level controls. Threat intelligence sharing platforms should be updated with the detection count (11/95) and the blocklist reference (PhishDestroy) to improve community awareness.