home-openses-io[.]pages[.]dev

Analysis of home-openses-io.pages.dev indicates a confirmed credential phishing operation, currently offline as of July 24, 2026. The domain was registered on February 21, 2026, through Cloudflare, Inc., and resolved to IP 188.114.97.3 (AS13335, Cloudflare, Inc., US). It was flagged by Google Safe Browsing for social engineering and appears on one security blocklist. The domain's SSL certificate, issued by Google Trust Services (WE1), and HTTP status 403 suggest it was actively blocked or restricted prior to takedown.

Gridinsoft assigned a trust score of 0/100, reinforcing its malicious classification. VirusTotal detections (10 of 93 security vendors) further corroborate its phishing nature, though the exact payload or targeted brand remains unconfirmed due to the domain's current offline status. Infrastructure analysis reveals Cloudflare-hosted nameservers (skip.ns.cloudflare.com, diva.ns.cloudflare.com) and technologies including HSTS and HTTP/3, typical of modern phishing campaigns leveraging CDN services for evasion. The page title, 'Suspected phishing site | Cloudflare,' aligns with automated or manual takedown notices, though no additional forensic artifacts (e.g., phishing kit fingerprints) are available in the provided intelligence.

Defenders should treat this domain as high-risk for credential theft. Block all resolutions to 188.114.97.3 and monitor for re-registration or DNS changes. If logs indicate prior user interaction, initiate password resets and review authentication anomalies. The absence of confirmed brand targeting or kit details limits attribution, but the social engineering flag and credential phishing classification warrant proactive containment.