serrvice-start-io[.]pages[.]dev

PhishDestroy identifies serrvice-start-io.pages.dev as an active phishing-as-a-service endpoint presently under investigation for generic credential harvesting. The domain resolves to 188.114.96.3 and is fronted by a Google Trust Services SSL certificate, indicating strong evasion tactics commonly used in modern credential phishing campaigns. This domain was flagged with 0 detections out of 95 engines on VirusTotal, remains unlisted on public blocklists, and is registered through Cloudflare, Inc. The service leverages Google-hosted infrastructure and free *.pages.dev subdomains to distribute phishing kits targeting unsuspecting users under the guise of “service-start” portals. Users should refrain from interacting with any content hosted at serrvice-start-io.pages.dev and report the domain to their security teams immediately. Organizations are advised to block both the domain and IP 188.114.96.3 at network perimeters and inspect DNS logs for queries to *.pages.dev subdomains. Immediate credential rotation is recommended for any user who may have entered information into the portal.