iscans-biz-438223[.]pages[.]dev

Analysis of iscans-biz-438223.pages.dev indicates that the domain is actively used for malicious purposes. The domain resolves to the IP address 188.114.96.3, a host commonly associated with Cloudflare's shared infrastructure. Both authoritative name servers, keaton.ns.cloudflare.com and magali.ns.cloudflare.com, are operated by Cloudflare, Inc., confirming that the registration and DNS services are provided through the same provider. The domain is currently listed on three independent security blocklists and has been explicitly blocked by PhishDestroy, MetaMask, and SEAL, suggesting that multiple security products have identified it as a threat vector.

VirusTotal scans show that four of ninety‑one security vendors have flagged the domain, providing additional corroboration of its malicious reputation. The presence of these detections, combined with the blocklist listings, points to a high likelihood that the site is being used for phishing attacks, even though no detailed page content or SSL certificate information is publicly available. Defenders should treat any network traffic to or from iscans-biz-438223.pages.dev as hostile.

Recommended mitigation steps include adding the domain to internal deny lists, enforcing outbound DNS filtering to block resolution, and monitoring for any attempted connections from internal hosts. Incident response teams should also review logs for evidence of credential submission or credential‑stealing activity that may have been directed at this domain. Continuous re‑evaluation is advised, as threat actors may shift hosting or alter the domain's configuration, but the current evidence base justifies an elevated risk posture.