whitelist-safeglobal[.]pages[.]dev

Analysis indicates that the domain whitelist-safeglobal.pages.dev was registered on March 27 2026 through Cloudflare, Inc. The authoritative name servers are serenity.ns.cloudflare.com and tom.ns.cloudflare.com, pointing to the Cloudflare network. DNS resolution returns the address 172.66.47.116, which is part of Cloudflare's edge infrastructure. The domain appears on three independent phishing blocklists—PhishDestroy, ScamSniffer, and Enkrypt—demonstrating that multiple threat‑intelligence feeds have observed malicious activity associated with it.

VirusTotal has recorded six positive detections out of ninety‑one submitted security vendors, confirming that at least a subset of scanning engines consider the host malicious. No additional metadata such as SSL certificate details, HTTP response codes, or page titles is currently available, so the exact content served by the site cannot be described. The lack of publicly disclosed page‑level indicators limits attribution of a specific phishing lure, but the presence on dedicated phishing blocklists and the detection count justify an elevated risk rating.

Defenders should add whitelist-safeglobal.pages.dev to network‑level deny lists, enforce DNS filtering against the three listed blocklists, and monitor traffic to the associated Cloudflare IP for anomalous patterns. Because the domain is hosted on a shared Cloudflare edge, blocking the IP may affect other legitimate services; therefore, precise domain‑based filtering is recommended. Continuous re‑evaluation is advised as additional intelligence, such as page titles or SSL fingerprints, becomes available.