abi-vm[.]pages[.]dev

Analysis of abi-vm.pages.dev, observed on July 19, 2026, indicates active malicious infrastructure consistent with a generic phishing campaign. The site presents the page title "CODE COMPILER" and serves content over HTTPS using a Google Trust Services / WE1 certificate, suggesting a legitimate‑looking TLS layer. DNS resolution points to IP 172.66.47.180, an address owned by Cloudflare, Inc. and geolocated to Canada. The domain is hosted on Cloudflare Pages, a service frequently leveraged for rapid deployment of fraudulent pages. VirusTotal records show that 2 of 91 scanning vendors have flagged the domain, and it appears on a single external blocklist, where PhishDestroy has already listed it as blocked. HTTP response code 200 confirms the page is reachable. While the limited vendor detections and single blocklist entry suggest early-stage detection, the combination of a high‑risk classification, active status, and the presence of a reputable TLS certificate are typical of phishing infrastructure designed to evade cursory scrutiny. Defenders should add abi-vm.pages.dev to URL filtering rules, monitor outbound connections to the associated IP, and consider broader threat‑intel sharing to improve detection coverage. Ongoing observation is recommended to capture any evolution of the payload or additional infrastructure components.