chainlist-nodes[.]pages[.]dev

The domain chainlist-nodes.pages.dev was observed on 29 July 2026 as an active generic phishing infrastructure. DNS resolution maps the hostname to the IPv4 address 172.66.44.59, a Cloudflare‑owned address that suggests the use of Cloudflare’s proxy service. The domain is registered through Cloudflare, Inc., and the authoritative name servers are coco.ns.cloudflare.com and huxley.ns.cloudflare.com, confirming reliance on Cloudflare’s DNS platform. VirusTotal analysis shows that nine out of ninety‑one scanning engines have flagged the domain as malicious, indicating partial consensus among security vendors.

The domain also appears on a single external blocklist and is actively blocked by the PhishDestroy service, providing additional evidence of its malicious reputation. Publicly available intelligence does not include a page title, SSL certificate details, or explicit branding information, leaving the exact content of the landing page unverified. Consequently, the precise phishing lure and target audience remain uncertain. The lack of visible brand attribution or kit identification prevents attribution to a specific campaign beyond the generic phishing classification.

Defenders should treat chainlist-nodes.pages.dev as a high‑risk indicator. Immediate actions include adding the domain to DNS and proxy blocklists, enforcing outbound filtering to prevent connections to the associated IP, and monitoring for any changes to the underlying DNS records or name‑server configuration. Integration of the observed detection count and blocklist presence into security information and event management (SIEM) rules will improve early detection of related traffic. Continuous re‑evaluation is advised, as additional analysis of the HTTP response and page content may reveal further malicious behavior.