amp-cipta88[.]pages[.]dev

Analysis indicates the domain amp-cipta88.pages.dev (registered September 2, 2020) is actively hosting a credential phishing page targeting users of an online gaming platform. The page title, "CIPTA88: Game Perkalian Berganda Paling Inovatif Dapatkan Free Spin Emas dengan Multiplier Tertinggi!", suggests the site impersonates a gaming service offering free spins or multipliers, a common lure for credential theft. Infrastructure analysis reveals the domain resolves to IP 172.66.47.133 (AS13335, Cloudflare, Inc., US) and employs technologies including AMP, Lightbox, HSTS, and HTTP/3, with Cloudflare nameservers (adi.ns.cloudflare.com, henrik.ns.cloudflare.com, karl.ns.cloudflare.com, ursula.ns.cloudflare.com). The SSL certificate is issued by Google Trust Services (WE1). The domain is flagged on one security blocklist, and three of 93 security vendors on VirusTotal have detected it as malicious. The Gridinsoft trust score is 0/100, further indicating high risk. While the exact content of the phishing page remains unanalyzed, the combination of a gaming-themed lure, credential phishing classification, and active Cloudflare hosting suggests a targeted campaign. Defenders should block the domain at the DNS or proxy level, monitor for connections to 172.66.47.133, and alert users to the fraudulent gaming incentive scheme. No evidence of takedown or sinkholing was observed as of July 12, 2026.