izumi-finance[.]pages[.]dev

Analysis of izumi-finance.pages.dev, observed on 2026-08-03, indicates that the domain is presently active and classified as a generic phishing site under investigation. Registration data shows the domain was provisioned through Cloudflare Pages, a hosting service that often supplies shared infrastructure and can obscure the true origin of the content. The domain is listed on three public security blocklists and is actively blocked by the PhishDestroy, MetaMask, and SEAL blocklist providers, demonstrating that multiple independent threat-intel feeds have identified it as malicious. A VirusTotal query performed on the domain engaged 91 antivirus and sandbox engines; at the time of the scan no engine reported a detection.

The absence of detections does not constitute a safety assurance, as many phishing payloads evade static analysis and rely on dynamic interaction. No additional telemetry such as IP address, autonomous system number, geographic location, SSL certificate details, HTTP response codes, or page-title metadata is currently available in the intelligence feed. Consequently, the full scope of the infrastructure and the precise phishing campaign tactics remain uncertain.

Defenders should continue to block the domain at perimeter and endpoint layers, incorporate the three blocklist sources into their URL filtering rules, and monitor for any newly observed indicators such as DNS resolution changes, TLS certificate updates, or content hashes. Ongoing re-scans with dynamic analysis platforms are recommended to capture potential payloads that static scanners may miss. Organizations that handle financial credentials should treat any traffic to izumi-finance.pages.dev as hostile and enforce multi-factor authentication to mitigate credential compromise.