sift-11a[.]pages[.]dev

This domain is assessed as an active generic phishing infrastructure masquerading as a “Smart Shopping AI” service under the title Sift - Smart Shopping AI. Analysis indicates it is designed to present a benign or utility-oriented interface while potentially collecting sensitive user input such as credentials, personal data, or behavioral interaction patterns. The use of a seemingly legitimate AI shopping theme suggests an attempt to increase user trust and engagement, a common tactic in early-stage phishing campaigns or pre-credential harvesting landing pages. The infrastructure is currently active and may be used for dynamic payload delivery or redirection chains.

Technical evidence shows the domain sift-11a.pages.dev resolves to IP 188.114.97.3 and is hosted within Cloudflare, Inc. infrastructure in CA. The domain was created on April 06, 2026 and is registered through Cloudflare, Inc., indicating a recent deployment consistent with short-lived phishing environments. VirusTotal reports 0/95 detections at the time of analysis, indicating no broad signature-based detection coverage yet. However, the domain appears on 1 security blocklist and is currently blocked by PhishDestroy, suggesting behavioral or reputation-based classification despite lack of multi-engine detection.

If users have interacted with this domain, immediate precautionary actions are advised. Any credentials entered should be considered potentially compromised and must be reset across all affected accounts. Sessions should be invalidated, and authentication tokens revoked where applicable. Users should monitor accounts for unauthorized activity, particularly if any login or payment information was submitted. It is also recommended to clear browser storage, inspect for suspicious extensions or redirects, and ensure endpoint security scans are performed. Continued monitoring is necessary due to the domain’s active status and potential for rapid content modification or redeployment.