th-preprod[.]pages[.]dev

PhishDestroy identifies th-preprod.pages.dev as a live credential-phishing page designed to harvest usernames and passwords under the guise of a pre-production portal. Current risk level is classified as under_investigation; however, the convergence of low VirusTotal coverage (6/95 detections), Cloudflare infrastructure, and an IP address linked to known malicious campaigns elevates the threat to active credential harvesting.

Domain intelligence confirms th-preprod.pages.dev operates behind a Google Trust Services SSL certificate, resolves to the IPv4 address 188.114.96.3, and is registered through Cloudflare, Inc. Cloudflare’s Workers platform (pages.dev) is abused as a front end for the phishing kit. VirusTotal analysis returned 6 out of 95 detection engines flagging the URL as malicious as of the seed ff10cd query, leaving a critical detection gap. The site currently remains absent from blocklists curated by OpenPhish, PhishTank, and URLVoid, compounding the risk to end-users who may lower their guard in a pre-production environment.

Mitigation requires immediate network-level blocking of th-preprod.pages.dev and its resolving IP 188.114.96.3 via DNS sinkholing or firewall rules. Security teams should quarantine any systems that may have submitted credentials and force-password resets for exposed accounts. Deploy browser extensions that block .pages.dev subdomains and activate Cloudflare Browser Isolation for employees accessing dev environments. Continuous monitoring of newly registered *.pages.dev hostnames referencing 188.114.96.3 is recommended to preempt copycat phishing campaigns leveraging the same seed code ff10cd.