auth-coiinbse-prop-exesion-us[.]pages[.]dev

This domain, auth-coiinbse-prop-exesion-us.pages.dev, operates as a credential harvesting platform designed to mimic legitimate authentication portals. Analysis indicates the site presents fraudulent login interfaces, likely targeting users of financial services, corporate networks, or cloud applications. The objective appears to be the collection of usernames, passwords, and potentially multi-factor authentication codes through deceptive input forms that closely resemble genuine service providers. The domain employs social engineering tactics, such as urgency-driven messaging or spoofed branding, to manipulate victims into submitting sensitive credentials. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on November 01, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.44.200, associated with Cloudflare's network (AS13335). Security vendors have flagged the domain with a detection ratio of 14/95 on VirusTotal, while Google Safe Browsing and one additional blocklist classify it as phishing. The SSL certificate, issued by Google Trust Services (WE1), provides encrypted connections to the fraudulent site, further complicating detection for unsuspecting users. The page title, 'Suspected phishing site | Cloudflare,' suggests the hosting provider has identified and partially mitigated the threat, though the domain remained active long enough to pose a risk. Users who accessed auth-coiinbse-prop-exesion-us.pages.dev should assume their credentials were compromised and take immediate remediation steps. First, reset passwords for any accounts entered on the site, prioritizing email, financial, and work-related services. Enable multi-factor authentication where available, using app-based or hardware tokens instead of SMS. Monitor accounts for unauthorized activity, including login attempts, transactions, or configuration changes. If corporate credentials were exposed, notify internal security teams to investigate potential lateral movement or data exfiltration. Clear browser caches and saved passwords to prevent automatic re-entry into the malicious domain. Finally, report the incident to relevant fraud reporting platforms to contribute to broader threat intelligence efforts.