en-moemate[.]pages[.]dev

Analysis of en-moemate.pages.dev shows that the domain is actively being used for phishing operations. The site is listed on a security blocklist and was previously flagged by the PhishDestroy service, indicating that at least one reputable anti‑phishing feed has identified it as malicious. Registration data reveals that the domain was created on 14 January 2025 and is hosted on Cloudflare Pages, a platform that provides static site hosting and CDN services.

DNS resolution points to the IP address 172.66.44.74, which is owned by Cloudflare and is commonly shared among many unrelated sites, reducing the usefulness of IP‑based reputation alone. The domain was scanned by 91 VirusTotal vendors; none of those engines reported a detection, but the absence of a detection does not constitute evidence of safety, especially given the confirmed blocklist entry. No additional intelligence such as SSL certificate details, HTTP response codes, page title, or brand targeting is currently available, leaving the full scope of the phishing campaign uncertain.

Defenders should treat the domain as malicious, add it to outbound and inbound blocking rules, and monitor for any related domains that share the same Cloudflare Pages configuration or resolve to the same IP address. Continuous re‑scanning with multi‑engine services is recommended to capture any future changes in the payload or hosting infrastructure.