net-blocks[.]pages[.]dev

PhishDestroy identifies net-blocks.pages.dev as a suspected phishing page engineered to mimic Cloudflare Pages hosting, tricking visitors into entering sensitive credentials under a falsified domain. This site uses the .pages.dev subdomain namespace that Cloudflare reserves for legitimate Pages projects, which increases the risk of user confusion and successful credential harvesting. Researchers have observed similar patterns in campaigns where attackers abuse free subdomain services to deliver fake login prompts for popular platforms such as Google, Microsoft, or internal networks.

This domain was flagged as under investigation on PhishDestroy with 0 detections out of 95 VirusTotal scanners as of discovery. It was registered through Cloudflare, Inc., and resolves to 188.114.97.3, an IP address associated with Cloudflare’s global edge network. The SSL certificate is issued by Google Trust Services, adding superficial legitimacy to the page. This combination of trusted brand misuse and neutral hosting infrastructure makes detection challenging and emphasizes the need for proactive user verification before interacting with such domains.

If you have visited net-blocks.pages.dev—especially if you entered any login details or downloaded files—immediately change passwords on all accounts, especially those related to Cloudflare, Google, Microsoft, or enterprise portals. Use a separate device to log in only after clearing your browser cache or performing a session reset. Report the domain to your IT team or security provider and run a full antivirus scan. Forward the URL and any screenshots to PhishDestroy’s submission channel for further analysis to help protect others.