# fromtop.pages.dev — MALICIOUS

> Avoid fromtop.pages.dev—a high-risk phishing domain flagged and offline. Do not share personal info or credentials with this site.

## Summary
PhishDestroy identifies fromtop.pages.dev as a high-risk generic phishing domain involved in credential theft schemes. The domain was active in March 2026 and lured victims with deceptive tactics.

The domain resolved to IP 172.66.47.185 and was registered via Cloudflare, Inc. It appeared on two security blocklists and was flagged by 14 of 95 VirusTotal vendors. The page title indicated a suspected phishing warning by Cloudflare.

Currently, fromtop.pages.dev is taken offline. Users and organizations should block this domain and remain vigilant against similar campaigns leveraging newly created Cloudflare-hosted pages.

## Threat Details
- Verdict: MALICIOUS
- Site status: dead (HTTP 403)
- Page title: Suspected phishing site | Cloudflare

## Domain Intelligence
- Registered: 2026-03-10 13:07:01
- Registrar: Cloudflare, Inc.
- Country: US
- IP: 172.66.47.185
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: kinsley.ns.cloudflare.com trace.ns.cloudflare.com
- SSL Issuer: Google Trust Services / WE1

## Detection Status
- VirusTotal: 14 vendors flagged
  Vendors: ["ADMINUSLabs", "Criminal IP", "alphaMountain.ai", "BitDefender", "CyRadar", "ESET", "Fortinet", "G-Data", "Kaspersky", "Lionic", "Phishing Database", "Sophos", "VIPRE", "Webroot"]
- Google Safe Browsing: clean
- Blocklists: 2 hits
  Lists: ["PhishDestroy", "PhishingDB"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019cd7ab-a0a7-76b5-9204-fc13e558715a.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/d77f5001-a1fb-401d-8fee-aaa72bd4bcb6
- PhishDestroy: https://phishdestroy.io/domain/fromtop.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/fromtop.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/fromtop.pages.dev/
Last updated: 2026-03-19