billion-3f8[.]pages[.]dev

Analysis indicates that the domain billion-3f8.pages.dev was created on 2 September 2020 and is hosted on Cloudflare Pages, resolving to the IP address 172.66.46.248. The domain appears on a single security blocklist and is specifically listed by PhishDestroy as a malicious site. VirusTotal scans have recorded detections from 14 of 91 security vendors, confirming that the domain is presently flagged by multiple independent engines.

The registration through Cloudflare Pages suggests the use of a reputable CDN provider to hide the true origin of the content, a common tactic in phishing campaigns that rely on rapid deployment and easy teardown. The elevated risk rating and active status indicate that the site is still reachable and may be used to harvest credentials or deliver further malicious payloads. While the available data does not reveal the exact page title, targeted brand, or the specific phishing kit employed, the combination of blocklist inclusion, vendor detections, and the Cloudflare Pages infrastructure provides sufficient evidence to classify the domain as a confirmed phishing resource.

Defenders should add the domain and its resolved IP address to firewall and DNS filtering rules, monitor for any outbound connections to the IP, and consider sharing the indicator set with internal threat‑intel teams. Continuous re‑scanning with VirusTotal or similar services is recommended to track any changes in detection counts. Until further analysis of the hosted content is performed, the domain remains a high‑confidence malicious indicator.