auth-zeddex-swaap-io-us[.]pages[.]dev

PhishDestroy identifies the active domain auth-zeddex-swaap-io-us.pages.dev as a generic phishing host engaged in credential theft operations. The campaign exhibits no overt branding alignment, suggesting a drainer kit deployment targeting unsuspecting users through deceptive login prompts. Hosted via Cloudflare Pages, the domain masquerades as a legitimate authentication portal to harvest credentials for subsequent misuse. This domain resolves to IP 188.114.97.3 and possesses a Google Trust Services SSL certificate. VirusTotal currently flags the domain with a 2/95 detection score, indicating minimal antivirus coverage. Registered through Cloudflare, Inc., the domain remains under investigation with no confirmed blocklist entries as of this analysis. The technical indicators confirm the infrastructure leverages reputable services to enhance credibility while evading detection. The campaign remains active with status under investigation. Users should block the domain and IP 188.114.97.3 at the network perimeter. Immediate reporting to security teams is advised to mitigate credential harvesting risks. Remaining risk is assessed as moderate due to the domain’s live status and low detection coverage, warranting heightened vigilance.