idgn[.]pages[.]dev

The domain idgn.pages.dev is currently listed on four independent security blocklists and has been flagged by the PhishDestroy, MetaMask, ScamSniffer, and SEAL filtering services. VirusTotal reports that four of ninety‑one scanned scanners returned a malicious classification, indicating that at least a subset of detection engines recognize the host as malicious. Registration data shows the domain was created through Cloudflare, Inc., and it is served by the Cloudflare nameservers josephine.ns.cloudflare.com and shane.ns.cloudflare.com. DNS resolution points to the address 188.114.97.3, an IP address owned by Cloudflare and commonly used for content delivery and proxy services, which does not by itself prove legitimacy but aligns with the registrar information.

The threat profile categorizes the site as a generic phishing host, yet no additional intelligence such as a page title, SSL certificate details, HTTP response codes, or observed content has been published. Consequently, the precise phishing campaign vector, targeted brand, or credential‑stealing mechanism remains unknown. Absence of public OTX references or additional malware analysis further limits attribution. Defenders should treat idgn.pages.dev as hostile.

Immediate mitigation steps include adding the domain to DNS blocklists, configuring web‑proxy and endpoint security products to deny traffic, and ensuring that any existing URL filtering feeds that contain the domain are enabled. Continuous monitoring of outbound connections to the IP 188.114.97.3 is advised, as the address may be reused for other malicious actors. Organizations should also review recent user reports for phishing attempts that reference the domain and consider user education on unsolicited links. Because the domain is active and carries an elevated risk rating, periodic re‑evaluation of its status in threat‑intel platforms is recommended.