iohydan9[.]pages[.]dev

This domain, iohydan9.pages.dev, was registered on 30 April 2025 and currently resolves to 104.21.1.173, an address owned by AS13335 in the United States. The site presents a TLS certificate issued by Google Trust Services under the WE1 profile, indicating a valid‑looking HTTPS endpoint. HTTP requests return a 403 status code, and the page title reported by the scanner is “https://www.google.com/”, matching the declared target brand Google. The infrastructure uses two Cloudflare authoritative name servers (kyree.ns.cloudflare.com, evangeline.ns.cloudflare.com) and is hosted behind Cloudflare’s network. VirusTotal analysis shows that three of ninety‑five scanners flagged the domain, and the domain appears on a single security blocklist, where it is already listed by PhishDestroy. Reputation services assign a trust score of 1/100 (Scamadviser) and 0/100 (Gridinsoft), reflecting a high likelihood of malicious use. The observed characteristics—brand impersonation, low reputation scores, and partial detection—indicate an active high‑risk phishing campaign. Defenders should block the domain at perimeter filters, monitor DNS queries for the associated IP and name servers, and consider adding the address to internal blocklists. Continuous re‑scanning is recommended to capture any changes in payload or hosting configuration.