symbiosisfinance[.]pages[.]dev

Analysis indicates that symbiosisfinance.pages.dev was created on 2026-02-21 and registered through Cloudflare, Inc. The domain resolves to IP 172.66.47.89, which belongs to AS13335 Cloudflare, Inc. in the United States. TLS is terminated by a Google Trust Services / WE1 certificate and the site enforces HSTS while supporting HTTP/3, confirming that the hosting infrastructure is provided by Cloudflare. An HTTP request to the root returned status 403, and the page title displayed "Suspected phishing site | Cloudflare," suggesting that the content was taken down by Cloudflare’s automated takedown process. VirusTotal recorded detections by 2 of 93 security vendors, and the domain appears on one external blocklist, specifically PhishDestroy.

Additional reputation signals include a Gridinsoft trust score of 0 out of 100 and a single blocklist entry, reinforcing the malicious classification. The identified scam type is credential phishing, targeting user login credentials. Defenders should immediately add symbiosisfinance.pages.dev to deny‑list rules across DNS, proxy, and endpoint filtering solutions.

Monitoring of traffic to the associated Cloudflare IP range (172.66.47.0/24) is advised to detect any pivot or reuse of the infrastructure. Given the rapid registration date, future domains created under the same Cloudflare account or with similar naming patterns should be flagged for pre‑emptive review. Continuous ingestion of threat‑intel feeds that reference this domain, especially from PhishDestroy and VirusTotal, will help maintain up‑to‑date protection against potential re‑hosting attempts.