api-qubetics[.]pages[.]dev

PhishDestroy identifies api-qubetics.pages.dev as an active generic phishing domain masquerading as a legitimate service, leveraging Cloudflare Pages hosting to distribute deceptive login prompts. The domain exhibits no affiliation with a specific brand or drainer kit, relying on generic credential harvesting tactics to compromise user accounts. Analysis reveals a deliberate attempt to mimic trusted platforms, likely targeting unsuspecting users through social engineering or malicious redirects.

Technical indicators confirm minimal detection despite active phishing operations: VirusTotal reports 1/95 detections (fe91e4 seed), registered through Cloudflare, Inc., resolving to IP 188.114.97.3 via Google Trust Services SSL certificate. The domain’s infrastructure evades immediate blacklisting, with no blocklist entries recorded at this stage. Cloudflare’s rapid deployment of Pages hosting enables threat actors to obfuscate malicious intent, complicating takedown efforts and prolonging exposure.

This domain remains active with an under-investigation risk status, prompting ongoing monitoring by cybersecurity teams. Immediate safety recommendations include blocking the domain and IP 188.114.97.3 at the network perimeter, avoiding credential entry, and reporting the domain to PhishDestroy for further analysis. The absence of blocklist entries underscores the need for proactive threat hunting, as the domain’s low detection profile poses a latent risk to end users and organizational networks alike.