desktop-en-home[.]pages[.]dev

Analysis as of July 29, 2026 indicates that desktop-en-home.pages.dev is currently active and classified as a generic phishing threat with an elevated risk rating. The domain resolves to the IPv4 address 172.66.47.52 and is hosted behind Cloudflare, Inc., as evidenced by the registrar information and the authoritative name servers paityn.ns.cloudflare.com and thomas.ns.cloudflare.com. Cloudflare’s front‑end service may obscure the true origin of the malicious infrastructure, complicating attribution efforts. The domain is already listed on one security blocklist and has been specifically blocked by the PhishDestroy feed, providing an early indicator for network‑level defenses.

VirusTotal scans show that nine out of ninety‑one antivirus and URL‑reputation engines have flagged the domain, reinforcing the suspicion of malicious use. No additional data such as Safe Browsing status, Open Threat Exchange entries, SSL certificate details, or page‑title information is presently available, leaving the full scope of the hosted content unverified. Defenders should prioritize immediate containment by adding desktop-en-home.pages.dev to URL filtering policies and by denying outbound connections to its resolved IP address 172.66.47.52. Because the domain is served through Cloudflare, traffic may be multiplexed with legitimate services, so it is advisable to monitor DNS queries for the domain and its associated name servers for anomalous resolution patterns.

Continuous ingestion of threat‑intel feeds that reference the domain, as well as periodic re‑scanning on VirusTotal or similar platforms, will help capture any evolution in the detection profile. Organizations should also consider sharing observables with industry‑wide blocklists to improve collective visibility. Until further content analysis is obtained, the presence on a blocklist and multiple vendor detections warrants treating the domain as malicious and enforcing strict blocking across all ingress and egress points.