landing-purefi-io-safari[.]pages[.]dev

PhishDestroy identifies landing-purefi-io-safemode.pages.dev as an active generic phishing domain designed to deceive users into divulging sensitive information under false pretenses. The page mimics legitimate service interfaces, leveraging Cloudflare Pages hosting to obfuscate its malicious infrastructure. Threat actors commonly deploy such domains in widespread credential harvesting campaigns, often masquerading as financial, tech, or support portals to lure victims. This domain was flagged through automated threat intelligence pipelines, revealing key technical indicators for security teams. It resolves to IP address 172.66.47.102 via Cloudflare, Inc., a common hosting provider for both benign and malicious content due to its privacy-preserving features. Current VirusTotal analysis shows 2 out of 95 security engines detecting the sample, indicating a newly emerged or actively evolving threat that has evaded signature-based detection. The use of Cloudflare Pages, a legitimate platform, further complicates takedown efforts and enhances operational security for attackers. Users who have encountered this domain should immediately cease any interaction and avoid entering personal or credential information. If credentials were submitted, change passwords immediately and enable multi-factor authentication on all related accounts. Report the domain to your security team or via platforms like PhishDestroy’s threat submission portal. Network defenders are advised to block the resolved IP 172.66.47.102 and monitor for outbound connections to this host. Given the low detection rate, proactive blocking at the DNS or firewall level is recommended to mitigate potential compromise.