magamovement[.]pages[.]dev

The domain magamovement.pages.dev was registered on August 06, 2024 and is currently active. The site returns HTTP 200 and presents a page titled “Bot Verification”. The content is classified as generic_phishing with a credential phishing objective, indicating an attempt to harvest user credentials. Infrastructure analysis shows the domain resolves to the IPv6 address 2606:4700:310c::ac42:2c59, which belongs to AS13335 Cloudflare, Inc. The hosting is provided through Cloudflare’s network, with nameservers elmo.ns.cloudflare.com and dalary.ns.cloudflare.com. The SSL certificate is issued by Google Trust Services under the WE1 root, and the site enforces HSTS and HTTP/3. Detected front‑end libraries include SweetAlert2, jsDelivr, cdnjs, and Cloudflare’s delivery services. Reputation services assign the domain extremely low trust scores (Scamadviser 1/100, Gridinsoft 0/100). The domain appears on three security blocklists, including PhishDestroy, ScamSniffer, and Enkrypt. No detections have been reported on VirusTotal at the time of analysis, but the lack of detections does not imply benign behavior. The combination of a newly created domain, low trust scores, and active blocklist listings supports a high‑risk profile. Defenders should block traffic to magamovement.pages.dev at perimeter firewalls and DNS resolvers, and add the IPv6 address to any network‑level deny lists. Monitoring of DNS queries for the associated nameservers can provide early warning of related campaigns. Incident response teams should treat any credentials submitted to this domain as compromised and enforce password resets for affected accounts. Continuous re‑evaluation is advised, as the infrastructure may shift if the attackers migrate to new hosting vectors.