data-center-restriction-reporting[.]pages[.]dev

This domain, data-center-restriction-reporting.pages.dev, is identified as a generic phishing gateway designed to mimic enterprise data center access portals or internal reporting systems. Analysis indicates no direct brand impersonation or cryptocurrency drainer functionality, but the infrastructure aligns with credential harvesting campaigns targeting corporate employees. The site likely presented fake login interfaces for internal tools, leveraging Cloudflare Pages hosting to evade detection and appear legitimate. Infrastructure analysis reveals the following technical indicators: the domain was registered on November 6, 2025, through Cloudflare, Inc., and resolves to the IP address 188.114.96.3, associated with Cloudflare’s network (AS13335). The SSL certificate is issued by Google Trust Services (WE1), a common configuration for Cloudflare-hosted properties. VirusTotal detection metrics show 17 out of 95 security vendors flagging the domain as malicious, while it appears on two security blocklists, including PhishDestroy and PhishingDB. Google Safe Browsing status is not explicitly provided, but the domain’s offline status suggests prior flagging. The domain is currently offline, likely taken down following detection by security vendors and blocklist providers. Despite its inactive status, residual risk remains due to the domain’s recent creation and association with Cloudflare’s infrastructure, which is frequently abused for phishing operations. Organizations should monitor for similar domains leveraging Cloudflare Pages or Workers, particularly those mimicking internal reporting or access control systems. Network-level blocking of the resolved IP (188.114.96.3) and related AS13335 ranges is recommended as a precautionary measure. End-users should verify domain authenticity before entering credentials, especially for pages hosted on *.pages.dev subdomains.