onchaincert[.]pages[.]dev

PhishDestroy identifies onchaincert.pages.dev as a generic phishing domain actively distributing deceptive cryptocurrency certificates under Cloudflare’s Pages.dev infrastructure.

This domain was flagged by 1 of 95 VirusTotal vendors as of the latest scan, indicating a currently undetected threat. The domain is registered through Cloudflare, Inc., resolves to IP address 172.66.44.71, and is secured with a Google Trust Services SSL certificate. Despite zero detections on VirusTotal, the absence of community or vendor flags does not equate to safety. Historical data shows that such domains often appear benign until malicious activity escalates, particularly in campaigns targeting cryptocurrency users seeking certification credentials.

The domain is currently marked as active with a status of 'under investigation,' reflecting ongoing scrutiny by threat intelligence teams. Given the lack of immediate detection despite Cloudflare’s hosting and Google’s SSL trust chain, users should treat this domain with extreme caution. Concrete recommendations include avoiding any interaction with onchaincert.pages.dev, verifying the legitimacy of certificate providers through official channels, and reporting encounters to threat intelligence platforms. Network administrators are advised to monitor outbound traffic to IP 172.66.44.71 and block associated domains to prevent potential compromise in enterprise environments.