verify-badge-vip5[.]pages[.]dev

This domain, verify-badge-vip5.pages.dev, is identified as a credential theft operation designed to harvest user login credentials through deceptive login portals. Analysis indicates no direct association with a specific brand impersonation campaign or crypto drainer kit, though the infrastructure mimics legitimate verification processes to trick users into submitting sensitive information. The threat type aligns with credential phishing, where attackers exploit trust signals to prompt unauthorized data disclosure. Infrastructure analysis reveals the domain was registered on June 13, 2026, through Cloudflare, Inc., and resolves to the IP address 172.66.47.163. VirusTotal reports 15 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and holds a Gridinsoft trust score of 0/100. Technologies detected include HSTS and Cloudflare infrastructure, with an SSL certificate issued by Google Trust Services. No Google Safe Browsing (GSB) detections are recorded at the time of analysis. The domain is currently offline, having been taken down following detection and reporting. Response actions included revocation of hosting access and domain suspension. Despite its offline status, residual risk persists for users who may have interacted with the domain prior to takedown. Organizations are advised to monitor for unauthorized access attempts linked to credentials potentially exposed via this campaign. Network-level blocks should be implemented for the domain and associated IP to prevent residual exposure.