euhkskjvietkoreeark-geqrdmblxuksidbeluqcpiiu[.]pages[.]dev

The domain euhkskjvietkoreeark-geqrdmblxuksidbeluqcpiiu.pages.dev was created on 11 March 2026 and is currently taken offline. Infrastructure analysis shows the domain resolves to IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is located in the United States. The hosting provider is Cloudflare, as indicated by the presence of HSTS, HTTP/3 support and the use of Cloudflare’s nameservers jade.ns.cloudflare.com and lee.ns.cloudflare.com. The site presented the page title "Suspected phishing site | Cloudflare" and returned an HTTP 403 status code, suggesting intentional block or access restriction. TLS termination is performed by a Let’s Encrypt certificate (E7), confirming the use of standard HTTPS encryption.

Threat intelligence records show that 11 of 94 security vendors on VirusTotal flagged the domain, and the domain appears on a single security blocklist. The Gridinsoft trust score is 0 out of 100, indicating a high confidence of malicious intent. PhishDestroy has already blocked the domain, and the overall risk rating is elevated. No additional content analysis is available because the site is offline, so the exact phishing payload, target brand, or credential‑stealing mechanisms remain unknown.

Defenders should continue to block the domain and its associated IP address at perimeter firewalls and DNS filtering solutions. Monitoring for any re‑registration of the domain or reuse of the same IP range is advisable. Updating threat‑intel feeds with the observed indicators—domain name, IP address, Cloudflare nameservers, SSL certificate details, and the 403 response—will help prevent future exploitation. Until the domain is re‑activated, further behavioral analysis is not possible, but the existing evidence warrants maintaining the elevated risk posture.