freeiphone[.]pages[.]dev

Analysis indicates that freeiphone.pages.dev was registered on March 27, 2026 through Cloudflare, Inc. and is hosted on the Cloudflare network, resolving to IP address 172.66.44.207. The domain is served by the authoritative name servers kira.ns.cloudflare.com and nico.ns.cloudflare.com. It appears on a single external blocklist and has been added to the PhishDestroy blocklist, confirming that threat intelligence sources have identified it as malicious.

VirusTotal records show that the domain was submitted to 91 scanning engines, none of which produced a detection at the time of analysis; the absence of detections does not imply benign behavior and should be interpreted as inconclusive. No public SSL certificate details, HTTP response codes, or page title information are currently available, limiting the ability to assess surface‑level indicators such as certificate validity or content signals. The lack of Safe Browsing or Open Threat Exchange (OTX) entries further constrains confidence in automated reputation scores.

Given the registration date, the Cloudflare hosting, and the blocklist presence, the domain exhibits typical characteristics of a newly created phishing infrastructure. Defenders should consider adding freeiphone.pages.dev to deny‑list rules at perimeter firewalls and DNS filtering services, monitor network traffic for connections to 172.66.44.207, and ingest any future detections from threat feeds that reference this domain. Continuous re‑evaluation is advised, as additional artifacts such as page content, SSL fingerprints, or malicious payload hashes may emerge, allowing for more granular detection and response.