blockify-oi-lgon[.]pages[.]dev

The domain blockify-oi-lgon.pages.dev is currently active and classified as a generic phishing site with an elevated risk rating. Registration data indicates the domain was provisioned through Cloudflare, Inc., and it uses Cloudflare’s authoritative name servers armfazh.ns.cloudflare.com and galilea.ns.cloudflare.com. DNS resolution points to the IP address 188.114.96.3, which belongs to Cloudflare’s edge network, a common choice for threat actors seeking to obscure origin infrastructure. The domain appears on a single security blocklist and is explicitly blocked by the PhishDestroy service, demonstrating that at least one defensive product has identified it as malicious.

VirusTotal analysis shows that 11 of 91 scanning engines flag the domain, reinforcing the suspicion of malicious activity. No additional details such as page title, SSL certificate metadata, HTTP status codes, or content analysis have been published, leaving the specifics of the impersonated brand or service unknown at this time. Consequently, the exact nature of the credential‑stealing payload or any associated command‑and‑control endpoints cannot be confirmed. Defenders should prioritize immediate containment by adding blockify-oi-lgon.pages.dev to DNS sinkhole lists, firewall deny rules, and proxy filters.

Continuous monitoring of DNS queries for the domain and its associated IP address is recommended, as Cloudflare‑hosted domains can be rapidly repointed. Analysts should also track any future VirusTotal submissions or blocklist additions that may reveal additional indicators of compromise. Organizations employing email or web gateway security should ensure that the domain is included in URL reputation checks to prevent end‑user exposure. Until further forensic evidence becomes available, the domain should be treated as a high‑confidence phishing indicator.