bismilahi[.]pages[.]dev

Analysis of bismilahi.pages.dev, observed on July 29, 2026, indicates that the domain is actively being used for generic phishing. The domain is registered through Cloudflare, Inc., and resolves to the IP address 188.114.97.3, which is hosted by Cloudflare's network. VirusTotal records show that the domain was scanned by 91 security vendors, none of which reported a detection at the time of the scan; this absence of detections does not constitute a safety guarantee.

The domain appears on three independent security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, suggesting that multiple threat‑intelligence sources have identified malicious activity associated with it. Nameserver records list rocco.ns.cloudflare.com and sharon.ns.cloudflare.com, confirming the Cloudflare hosting environment. No publicly available page title, SSL certificate details, or HTTP response codes have been disclosed, leaving the exact content and credential‑harvesting mechanisms unverified.

Given the combination of active status, registration through a privacy‑preserving registrar, presence on blocklists, and inclusion in phishing‑specific blocklists, defenders should treat the domain as high‑risk. Recommended mitigations include adding the domain to network and endpoint blocklists, monitoring DNS queries for the IP 188.114.97.3, and employing URL filtering solutions that reference the listed blocklists. Continuous re‑evaluation is advised, as further analysis of the web content may reveal additional indicators of compromise.