captcha-da1[.]pages[.]dev

This domain, captcha-da1.pages.dev, is actively engaged in credential theft by impersonating a legitimate browser verification process. The page displays a deceptive 'Checking Your Browser...' prompt designed to harvest login credentials, session tokens, or other sensitive user data under the guise of a security check. Analysis indicates the site mimics common CAPTCHA or browser validation workflows, a tactic frequently employed to lower user suspicion while capturing input in real time. Infrastructure analysis reveals the domain was registered on March 25, 2026, through Cloudflare Pages, resolving to the IP address 172.66.44.73, which is geolocated to Cloudflare’s infrastructure in California. Despite its recent creation, the domain has already been flagged by one security blocklist, though it remains undetected by antivirus engines, with a VirusTotal score of 0/95. The SSL certificate is issued by Google Trust Services (WE1), a common feature in both legitimate and malicious sites leveraging Cloudflare’s network. Users who have interacted with captcha-da1.pages.dev should immediately terminate any active sessions and clear browser data, including cookies and cached credentials. If login details were entered, affected accounts must be secured by changing passwords and enabling multi-factor authentication where available. Network administrators are advised to block the domain and its resolving IP at the perimeter, while monitoring for indicators of compromise such as unusual login attempts or unauthorized access to linked accounts. Continuous scrutiny of Cloudflare-hosted subdomains with similar patterns is recommended due to the platform’s frequent abuse for phishing infrastructure.