btfd-big50[.]pages[.]dev

Analysis of btfd-big50.pages.dev shows a newly created domain (registered 2025‑01‑02) that is currently active and classified as a high‑risk generic phishing site. The domain is hosted on Cloudflare Pages and resolves to the IPv4 address 172.66.44.164. Reputation data indicate that the domain appears on four independent security blocklists and is explicitly blocked by PhishDestroy, MetaMask, ScamSniffer and SEAL. VirusTotal scans have returned detections from 12 of 91 antivirus engines, reinforcing the malicious assessment.

No additional telemetry such as SSL certificate details, HTTP response codes, or page title information is available in the current intelligence set, so the exact content served by the site remains unverified. The combination of a recent registration date, Cloudflare Pages hosting, and multiple blocklist listings suggests the domain is part of a broader phishing infrastructure that leverages free hosting to reduce operational costs. Defenders should add the domain and its resolving IP address to deny‑list rules across perimeter firewalls, DNS filtering services, and endpoint protection platforms. Continuous monitoring of the IP 172.66.44.164 for new associations is advised, as Cloudflare‑hosted infrastructure can be repurposed for other malicious campaigns.

Organizations employing web‑filtering solutions should ensure that the four named blocklists (PhishDestroy, MetaMask, ScamSniffer, SEAL) are enabled to capture future requests to this domain. Incident response teams encountering traffic to btfd-big50.pages.dev should treat any credential or payment data submitted as compromised and advise affected users to change passwords and review account activity. Ongoing collection of HTTP headers, TLS handshake data, and page content is recommended to refine the attribution and support future takedown actions.