bookmark-de[.]pages[.]dev

Analysis of bookmark-de.pages.dev indicates that the domain was registered on November 27 2025 through the Cloudflare Pages service. Cloudflare Pages provides static‑site hosting on shared edge infrastructure, and the domain resolves to the IP address 172.66.44.205, which is owned by Cloudflare. The domain appears on one public security blocklist and is specifically listed by PhishDestroy as a malicious entry. A VirusTotal scan performed by 91 independent scanners returned no detections at the time of the scan; while the lack of detections does not constitute a safety guarantee, it demonstrates that known malware signatures have not yet flagged the site.

No public Safe Browsing, OTX, or other reputation feeds have reported the domain, and no TLS certificate details, HTTP status codes, or page title information are currently available in the intelligence set. Consequently, the observable indicators are limited to registration metadata, hosting details, and blocklist inclusion. The primary uncertainty is the actual content served by the domain. Without a harvested page snapshot, it is not possible to confirm the presence of credential‑harvesting forms, brand impersonation, or malicious payload delivery.

The classification as “generic phishing” is derived from the blocklist label rather than from direct content analysis. Defenders should treat the domain as potentially hostile. Recommended actions include adding 172.66.44.205 to network‑level deny lists for traffic to Cloudflare edge nodes that are not otherwise required, enforcing DNS filtering that blocks bookmark-de.pages.dev, and monitoring threat‑intel feeds for any subsequent changes such as the appearance of the domain on additional blocklists or detection by sandbox scanners. Continuous re‑evaluation is advised, given the recent creation date and the possibility of rapid deployment of phishing kits on the Cloudflare Pages platform.