us-en--deffillama-io[.]pages[.]dev

This report analyzes a threat domain that presented a suspected phishing site. The page title was "Suspected phishing site | Cloudflare," indicating the site was likely blocked or flagged by Cloudflare's security systems. The domain posed a credential phishing threat, aiming to deceive users into providing sensitive login information.

Technical evidence confirms the malicious nature of the domain. VirusTotal flagged it with 10 detections out of 95 security vendors. Google Safe Browsing flagged it for social engineering. The domain was registered with Cloudflare, Inc. on 2025-10-25 and hosted on IP address 172.66.44.93, assigned to AS13335 Cloudflare, Inc. in the United States. The SSL certificate was issued by Google Trust Services / WE1, and the nameservers were hans.ns.cloudflare.com and rosalyn.ns.cloudflare.com. The domain was flagged by ADMINUSLabs, ChainPatrol, alphaMountain.ai, BitDefender, and CyRadar.

The domain is currently offline and down. Its GridinSoft trust score is 0 out of 100, and its DOM risk score is 95, indicating a very high risk. The domain is listed on 1 blocklist. Due to the confirmed phishing threat and high risk score, this domain should be considered a significant security threat and blocked.