squidgrow-migrate[.]pages[.]dev

This domain, squidgrow-migrate.pages.dev, is an active phishing site hosted on Google Pages and delivered through Cloudflare infrastructure. The site is designed to trick users into entering sensitive credentials, posing as a migration tool. PhishDestroy identifies this as a credible threat vector targeting unaware users who may confuse legitimate Google Pages subdomains with fraudulent ones. The campaign exploits the trust in Google’s hosting platform while leveraging Cloudflare’s fast CDN to obscure malicious infrastructure, making detection and takedown more difficult. The domain currently shows no detections on VirusTotal despite its active status, indicating a low-profile operation that may evade traditional security measures. This domain was flagged through continuous monitoring of Google Pages subdomains used in unauthorized campaigns. According to investigative data, squidgrow-migrate.pages.dev resolves to IP address 188.114.96.3 and operates with an SSL certificate issued by Google Trust Services, which adds a layer of false legitimacy. VirusTotal analysis shows 0 detections out of 95 security vendors at the time of discovery, reflecting the stealthy nature of the campaign. The domain is registered through Cloudflare, Inc., which is often used by threat actors to hide origin servers behind proxy networks. The presence of a Google-hosted page is a deliberate tactic to bypass email filters and user skepticism, as many users associate *.pages.dev with legitimate Google services. If you have visited squidgrow-migrate.pages.dev or interacted with its content, immediately cease use of any credentials entered on the site. Disconnect from all active sessions and change passwords for accounts potentially exposed, prioritizing email and financial services. Scan your device for malware using updated antivirus software, as secondary payloads could have been delivered through the page. Report the domain to your email provider, browser security teams, and threat intelligence platforms such as VirusTotal or PhishDestroy to aid in blocking and investigation. Avoid accessing the site further, as it remains active and poses ongoing risk to users who may be redirected through compromised channels or malicious ads. Always verify the legitimacy of migration or tool-related pages by checking official domains and using secure bookmarks for critical services.