gaslagiajaudah[.]pages[.]dev

PhishDestroy identifies gaslagiajaudah.pages.dev as a credential harvesting domain currently under active investigation for generic phishing activity. The domain employs a deceptive Pages.dev subdomain structure to masquerade as a legitimate service while targeting unsuspecting users. No specific brand or drainer kit has been directly linked to this domain at the time of analysis, though the operational pattern aligns with traditional credential theft campaigns. The infrastructure leverages Cloudflare’s Pages service, which is frequently abused for hosting phishing lures due to its legitimate appearance and rapid deployment capabilities. This domain resolves to IP address 172.66.44.168 and is registered through Cloudflare, Inc. VirusTotal currently shows 0 detections out of 95 engines (0/95), indicating a low detection rate despite its malicious intent. The SSL certificate is issued by Let’s Encrypt, a common choice among threat actors to avoid immediate browser warnings. As of this analysis, the domain has not been flagged by Google Safe Browsing (GSB), and blocklist inclusion remains unverified at this stage. The registration details and hosting infrastructure suggest a deliberate attempt to evade detection through legitimate service providers. The current status of gaslagiajaudah.pages.dev is marked as active, with an under investigation risk level pending further forensic analysis. Immediate response actions include blocking the domain at the network perimeter and monitoring for associated IOCs. While the technical indicators suggest a relatively new or undetected threat, the lack of detections does not equate to safety. Users and organizations are strongly advised to treat this domain as hostile and implement proactive measures such as DNS filtering, browser-based protections, and user awareness training to mitigate potential exposure. Remaining risk is assessed as moderate given the domain’s active status and the absence of widespread detection.