phanttm-en[.]pages[.]dev

Analysis of phanttm-en.pages.dev indicates a credential phishing operation hosted on Cloudflare Pages infrastructure. The domain, registered on February 21, 2026, through Cloudflare, Inc., is currently offline, returning an HTTP 403 status with a page title explicitly labeled 'Suspected phishing site | Cloudflare.' This suggests Cloudflare's automated systems or manual review flagged the content prior to takedown. The domain resolves to IP 188.114.96.3 (AS13335, Cloudflare, Inc., US), a shared hosting environment commonly used for both legitimate and malicious content. SSL certificate issued by Google Trust Services (WE1) confirms encrypted connections, though encryption alone does not indicate legitimacy. Detection data is limited but consistent with phishing activity: three of 95 security vendors on VirusTotal flagged the domain, and it appears on one security blocklist (PhishDestroy).

Gridinsoft assigns a trust score of 0/100, reinforcing the malicious classification. No specific brand impersonation or phishing kit is identified in the available data; the scam type is categorized as credential phishing based on the provided intelligence. Nameservers (ryleigh.ns.cloudflare.com, nicolas.ns.cloudflare.com) and detected technologies (HSTS, Cloudflare, HTTP/3) align with typical Cloudflare-hosted properties, offering no unique attribution beyond the hosting provider. Defenders should treat this domain as confirmed malicious for credential harvesting. Block DNS resolution and HTTP/HTTPS traffic to 188.114.96.3 for this domain.

Monitor Cloudflare Pages for similar patterns (e.g., newly registered subdomains under pages.dev with phishing-related page titles or HTTP 403 responses). While the domain is offline, historical logs should be reviewed for prior connections, particularly from endpoints handling sensitive credentials.