freeaiai[.]pages[.]dev

PhishDestroy identifies freeaiai.pages.dev as an active phishing domain leveraging AI-themed lures to deceive users. This site poses an elevated risk due to its malicious intent, specifically targeting individuals with fraudulent AI service offers. The threat is not generic but explicitly designed to harvest credentials or deploy malware under the guise of artificial intelligence tools. Technical analysis confirms the domain’s malicious infrastructure, warranting immediate caution and remediation actions.

This domain was flagged by 6 out of 95 security vendors on VirusTotal, indicating a significant but not universal detection rate. Registered through Cloudflare, Inc., the domain resolves to IP address 188.114.97.3 and holds an SSL certificate issued by Google Trust Services, which may enhance its perceived legitimacy. Given these attributes, blocklist scrutiny and trust scores suggest partial visibility but insufficient global blocking to fully mitigate the threat.

Mitigation for this AI-themed phishing scam requires immediate user awareness and organizational controls. Users should avoid interacting with the domain and report any encounters to their security teams. Organizations should update firewall rules to block IP 188.114.97.3 and domain freeaiai.pages.dev at the network perimeter. Endpoint detection and response (EDR) tools should monitor for associated artifacts, including SSL certificate fingerprints tied to Google Trust Services. Proactive threat intelligence feeds can help preemptively identify similar domains leveraging AI lures.