onionfd[.]pages[.]dev

Onionfd.pages.dev is currently flagged as an active generic phishing infrastructure with an elevated risk rating. The domain was registered on August 28, 2024 through Cloudflare Pages, leveraging Cloudflare’s hosting platform to obtain the public IP address 172.66.47.89. DNS resolution to this address is consistent across recent queries, indicating a stable hosting configuration. Reputation data shows the domain is listed on a single security blocklist and is actively blocked by the PhishDestroy service.

VirusTotal analysis reports that ten of ninety‑one scanning engines have raised detections, confirming malicious activity despite the majority of scanners not flagging the site. The limited blocklist presence suggests the campaign may be in early stages or employing evasion techniques to avoid broader blacklisting. No additional intelligence such as SSL certificate details, page title, or brand targeting is presently available, leaving the specific phishing lure and victim profile unknown.

Defenders should incorporate the domain and its resolved IP address into DNS and proxy filtering rules, ensure that outbound connections to 172.66.47.89 are denied, and monitor for any client‑initiated requests to the domain. Continuous re‑scanning on VirusTotal and periodic checks against emerging blocklists are recommended to capture any escalation in detection rates. Given the active status and elevated risk, organizations should treat traffic to onionfd.pages.dev as malicious and apply appropriate containment measures.