TLD Threat Intelligence

Flagged .dev Domains

166 domains using the .dev extension have been flagged by threat-intelligence feeds. The .dev extension is not specifically high-risk, but it is still used by scammers. The TLD alone does not determine whether a specific domain is safe.

166
Flagged Domains
34
Avg Risk Score
May 29
Last Flagged

Flagged .dev Domains

60 shown
DomainLast Seen
media-post-case-202630-8bt.pages.dev May 29 media-post-case-202639.pages.dev May 29 media-post-case-202631.pages.dev May 29 media-post-case-202632.pages.dev May 29 media-post-case-202637.pages.dev May 29 wertyuioxcvbnm-n3vy6ynu3k.edgeone.dev May 28 plain-dawn-63d3.herberthc88.workers.dev May 26 start-ledge-en.pages.dev May 26 kjwertyuiopcvbnm-u3qrobqifp.edgeone.dev May 25 ldgrijsjbhj.malibu02.workers.dev May 21 picture-ads-202665.pages.dev May 21 viso26.pages.dev May 20 netflix-family-affair.pages.dev May 20 pastee.dev May 19 shaw-tracker.pages.dev May 19 xfvhg-pmsm-npe5.p-mv4ac1tf.workers.dev May 19 dropship.mach95.dev May 19 voicemail-receivedon365portal.pages.dev May 19 18feb38d-9304-49ed-8a45-4b919bb3ed9f-netflix-clone-fixed.pages.dev May 19 36476-dashcloud.pages.dev May 19 wanderingad0be-hat-ecad.adfd7788ab030a3e21c4845a.workers.dev May 19 ttrdoc.alian35.workers.dev May 17 meet-googlee767585876.pages.dev May 16 g2lle-emeet84354258763ew.pages.dev May 16 meet-gooogle-us767496537936.pages.dev May 16 meet-gooogle-us65745874789.pages.dev May 16 meet-googlee463446729.pages.dev May 16 goglle-emeet83862847355.pages.dev May 16 m33t-eeuugogole8537897809.pages.dev May 16 meet-gooogle-us65783389343989.pages.dev May 16 meet-googlee4567898089.pages.dev May 16 meet-googlee46347975696.pages.dev May 16 meet-googlee7823629056.pages.dev May 16 meet-gooogle-us76735785946.pages.dev May 16 meet-gooogle-us7846597567673.pages.dev May 16 meet-googlee7563454656.pages.dev May 16 meet-gooogle-us6764848955945.pages.dev May 16 meet-goooglew48938395878.pages.dev May 16 g2lle-emeet843542456789262421.pages.dev May 16 confidentialitydocsignpreviewhbnz45h.pages.dev May 16 meishijia.pages.dev May 16 lgdxt-kbmb-m5yy.c-0ijbhkyh.workers.dev May 16 verifyportal-edocavailableo1e2c2b4.buddyl.workers.dev May 16 customer-sp-alexk.pages.dev May 15 nirdex-salvin-biz-vartor-lonvik-sp7ct12.pages.dev May 14 araxo-biz-kerqix-12260.pages.dev May 13 meta-circle-1sw.pages.dev May 13 see-ledgr-live.pages.dev May 13 mornin.rwks332.workers.dev May 13 box-core-cmbn.p-dt6nzr1j.workers.dev May 13 dpuqq-anbp-t8kh.c-1o2k0n4w.workers.dev May 13 pub-f4bf4b5c581d4d2fae8ac6d8e8ea7310.r2.dev May 12 red-mud-f702.kendallelsaxbthtp0668.workers.dev May 12 finance-ndax.pages.dev May 12 synva-nalra-biz01-prixo-dexma-spct1.pages.dev May 12 us-support-ledgor-en.pages.dev May 11 lzlwj.pages.dev May 11 work-with-us-31m.pages.dev May 11 smatr-5064-metropolitan.pages.dev May 11 jus-sup-21399932.pages.dev May 11

Frequently Asked Questions

Are all .dev websites scams?

No. The .dev extension is not specifically high-risk, but it is still used by scammers. The TLD alone does not determine whether a specific domain is safe. Many legitimate sites use .dev. This page lists only the specific .dev domains flagged by threat-intelligence feeds — not the extension as a whole.

Why do scammers use .dev domains?

Scammers favour cheap, fast-to-register extensions with slower abuse enforcement, because they expect the domain to be taken down within days. Registration cost and enforcement speed — not the extension's purpose — drive the choice.

How do I check if a specific .dev site is safe?

Look it up here or on Google Safe Browsing and VirusTotal, and check its registration date with a WHOIS lookup. Very new domains imitating an established brand are a strong warning sign.

🔐Security Partner

Stop the next phishing attack before you click.

NordPass autofill only triggers on real domains. Fake login pages cannot trick it into entering your credentials.

Try NordPass →
← All flagged TLDs