sajanji[.]pages[.]dev

Analysis of the domain sajanji.pages.dev confirms active malicious infrastructure targeting credential harvest. The domain was registered on June 08, 2026 through Cloudflare Pages, a hosting service that often abstracts the underlying server details. DNS resolution points to the IP address 172.66.47.56, which belongs to Cloudflare’s edge network, making attribution to a specific operator difficult. VirusTotal data shows that 1 of 91 security vendors has flagged the domain, indicating at least one detection engine has identified malicious behavior, though the majority of scanners have not raised an alert.

The domain appears on a single security blocklist and is explicitly blocked by the PhishDestroy service, reinforcing the view that it is being used for phishing campaigns. Risk is classified as elevated and the status remains active, suggesting ongoing exploitation. Defenders should treat the domain as hostile. Immediate actions include adding sajanji.pages.dev to web‑filter blocklists, sinkholing the IP if possible, and monitoring outbound DNS queries for connections to 172.66.47.56.

Because the hosting is on Cloudflare Pages, traditional takedown requests may be less effective; instead, coordinated reporting to Cloudflare’s abuse team is recommended. Continuous re‑evaluation is needed, as additional security vendors may raise detections and more blocklists could adopt the domain. Until further intelligence is gathered, the domain should be considered unsafe for any legitimate traffic.