tessstt-1x8[.]pages[.]dev

PhishDestroy identifies an active credential-harvesting campaign operating from tessstt-1x8.pages.dev, a domain impersonating a legitimate service to steal user login credentials. This infrastructure abuses Cloudflare Pages’ free tier to host spoofed login portals that harvest credentials under the guise of authentication, redirecting victims to attacker-controlled backend servers. The domain resolves to IP 172.66.44.127 and currently shows zero detections on VirusTotal, indicating low signature coverage despite active abuse. This domain was flagged by PhishDestroy seed bef891 with the following technical indicators: VirusTotal score of 2 out of 95 detections as of investigation time, registered through Cloudflare, Inc., and hosted on Cloudflare Pages infrastructure (172.66.44.127). The domain leverages Google Trust Services SSL certificates to appear legitimate, increasing the likelihood of successful deception. Given the zero-detection status, this campaign evades traditional defenses, posing a significant risk to users who may unknowingly submit credentials. Users who visited tessstt-1x8.pages.dev should immediately review accounts for suspicious activity, change passwords on unrelated services if reused, and scan devices with updated antivirus tools. Disable autofill for forms and monitor financial accounts for unauthorized transactions. Report the domain to your security team and avoid re-entry of credentials on any page linked from this domain. Block the domain at network and endpoint levels to prevent further exposure to this credential-harvesting campaign.