join-radium-io[.]pages[.]dev

Analysis of join-radium-io.pages.dev shows multiple indicators of credential‑phishing activity. The domain was created on 21 February 2026 and is hosted behind Cloudflare’s network, resolving to IP 172.66.47.133, which belongs to AS13335 Cloudflare, Inc. in the United States. DNS resolution uses Cloudflare‑owned authoritative nameservers howard.ns.cloudflare.com and penny.ns.cloudflare.com, confirming that the domain’s registration and DNS services are provided by Cloudflare, Inc. The site presents a TLS certificate issued by Google Trust Services under the WE1 identifier, indicating a valid HTTPS endpoint, yet the HTTP response currently returns a 403 status code, suggesting the content has been taken offline by the operator or a takedown request.

Reputation services provide consistent evidence of malicious intent. Google Safe Browsing flags the URL for social engineering, and PhishDestroy lists the domain as blocked. The domain appears on one additional security blocklist, and Gridinsoft assigns a trust score of 0 out of 100, the lowest possible rating. VirusTotal analysis shows that nine of ninety‑three scanning engines have flagged the domain, reinforcing the suspicion of phishing use.

The page title returned from the live endpoint reads "Suspected phishing site | Cloudflare," which directly labels the site as a phishing landing page. The known scam type is credential phishing, though the specific target brand or credential collection page has not been disclosed. No further content analysis is available because the site is offline, leaving the exact phishing lure and data‑capture mechanisms unverified.

Defenders should treat join‑radium‑io.pages.dev as a confirmed phishing indicator. Immediate actions include adding the domain and its resolved IP address to blocklists, updating intrusion‑prevention signatures, and monitoring for any related subdomains or newly registered domains that reuse the same Cloudflare nameservers.