diamond-fomo[.]pages[.]dev

On 24 July 2026 the domain diamond-fomo.pages.dev was observed hosting a credential‑phishing site. The site returned HTTP 403 and displayed the title “Suspected phishing site | Cloudflare”. DNS resolution points to 172.66.47.7, which belongs to Cloudflare’s network (ASN 13335) located in the United States. The domain was registered on 21 February 2026 through Cloudflare, Inc., and the TLS certificate was issued by Google Trust Services under the WE1 hierarchy, confirming a valid HTTPS endpoint. Cloudflare’s security stack is evident from the presence of HSTS, HTTP/3 and the Cloudflare name‑server pair sullivan.ns.cloudflare.com and naomi.ns.cloudflare.com.

Threat intelligence feeds have already flagged the domain. It appears on five blocklists – PhishDestroy, ScamSniffer, Polkadot, Enkrypt and Codeesura – and received a Gridinsoft trust score of 0 out of 100. VirusTotal analysis shows a single positive detection out of 93 scanned security vendors, reinforcing the malicious classification. The site is currently offline, as indicated by the “taken offline” status in the intelligence feed. While the page title confirms the presence of a generic “Suspected phishing site” banner, no specific targeted brand or credential‑type login page has been captured, leaving the exact victim‑targeting vector uncertain.

The combination of a freshly created domain, Cloudflare‑hosted infrastructure, a valid Google‑issued certificate, and rapid inclusion on multiple anti‑phishing blocklists suggests a typical credential‑phishing campaign that leverages the reputation of Cloudflare to evade basic reputation checks. Defenders should add diamond-fomo.pages.dev to local deny lists, block network connections to its resolved IP address, and monitor for any future re‑registration or similar domain patterns. Continuous observation of the associated Cloudflare name‑servers and the listed blocklists is recommended to detect potential re‑use.