startup-level-en-btsgets-up[.]pages[.]dev

PhishDestroy identifies startup-level-en-btsgets-up.pages.dev as an active credential phishing domain currently under investigation. This domain targets users with deceptive login pages mimicking legitimate services, aiming to harvest credentials under the guise of a startup-level enrollment portal. The threat is classified as active and remains unblocked by major security vendors, indicating a high risk of successful user compromise.

This domain was flagged with zero detections on VirusTotal out of 95 engines, resolving to IP address 188.114.97.3 with a valid SSL certificate issued by Google Trust Services. Registration was facilitated through Cloudflare, Inc., leveraging their infrastructure to obscure the true origin of the domain. The absence of detections suggests this phishing campaign is either newly deployed or employs evasion techniques undetected by current threat intelligence systems. No historical data indicates prior blocklisting or reputation scoring, further elevating the risk profile.

To mitigate exposure to this credential phishing domain, organizations should immediately block access to startup-level-en-btsgets-up.pages.dev at the network perimeter. Users should be alerted via security awareness training to scrutinize URLs containing 'pages.dev' and verify the legitimacy of startup-related enrollment communications. Implement DNS filtering to block resolution of the domain and its associated IP (188.114.97.3). Report the domain to Cloudflare’s abuse team and update browser-based blocklists to prevent accidental access. Monitor for anomalous login attempts linked to this domain’s infrastructure.