astra-sanctum[.]pages[.]dev

The domain astra-sanctum.pages.dev has been identified as a generic phishing site specifically designed to mimic legitimate security alerts, likely targeting users with fraudulent Cloudflare-themed pages. Analysis confirms this domain is actively used for credential harvesting and social engineering attacks. No legitimate brand affiliation has been verified, and the site currently displays a placeholder title indicating its removal or suspension. Infrastructure analysis reveals the domain was registered on October 22, 2025, through Cloudflare, Inc., and resolves to the IP address 188.114.97.3, hosted on AS13335 (Cloudflare, Inc.). The SSL certificate is issued by Google Trust Services (WE1), a common configuration for malicious sites leveraging free hosting services. Security vendors on VirusTotal flagged this domain at a rate of 16 out of 95, indicating moderate detection coverage. The domain appears on two security blocklists, including PhishDestroy and PhishingDB, and is currently labeled with the page title 'Suspected phishing site | Cloudflare,' further confirming its malicious intent. As of the latest assessment, astra-sanctum.pages.dev has been taken offline, though residual risks may persist if cached or archived versions remain accessible. Organizations and users are advised to block the domain at the DNS or firewall level, revoke any credentials potentially exposed through interaction with this site, and monitor for related indicators of compromise. Security teams should treat any prior access to this domain as a potential breach and conduct a thorough review of authentication logs for anomalous activity.