register-xionburntcom[.]pages[.]dev

This domain, register-xionburntcom.pages.dev, is an active phishing site hosted on Cloudflare Pages infrastructure, first observed on December 6, 2024. Analysis indicates a high-risk classification due to detection by multiple security vendors and inclusion on four blocklists. As of July 29, 2026, twelve of ninety-one security vendors on VirusTotal flag the domain as malicious, though the exact nature of the phishing content remains unconfirmed.

The domain resolves to IP address 188.114.97.3, a Cloudflare-hosted endpoint, which aligns with the registrar details provided. No specific brand impersonation or scam type has been identified in available data, though the domain name suggests a potential focus on cryptocurrency-related fraud, supported by its blocking by MetaMask and ScamSniffer. Defenders should treat this domain as hostile and prioritize blocking at the DNS or network layer.

Given its Cloudflare Pages origin, takedown requests may require direct engagement with Cloudflare's abuse team. Additional monitoring for related subdomains or IP-based indicators is recommended, as this infrastructure may be reused for further phishing campaigns. The domain's continued activity despite multiple detections suggests persistence by the threat actor, warranting heightened scrutiny of any associated traffic or user reports.