duck-purchase-website[.]pages[.]dev

PhishDestroy identifies duck-purchase-website.pages.dev as an active banking phishing page that masquerades as a legitimate purchase portal to steal financial credentials. This domain leverages Cloudflare Pages hosting and Google Trust Services SSL to appear trustworthy at first glance, luring victims into entering sensitive banking details under the guise of completing a transaction. The page remains undetected by 0 security engines on VirusTotal—raising urgency for users to verify any unexpected payment links before interacting with them.

This domain was flagged by PhishDestroy on seed 335223 after analyzing its infrastructure. It was registered through Cloudflare, Inc. using a Pages.dev subdomain, a common tactic among phishing actors to rapidly deploy fraudulent portals with minimal cost. The site resolves to IP 172.66.47.155 and holds a valid SSL certificate issued by Google Trust Services, further enhancing its credibility. With zero detections on VirusTotal as of the latest scan, this site is actively evading detection systems, potentially exposing unsuspecting users who click without verification.

If you visited duck-purchase-website.pages.dev, immediately cease any input and close the browser tab. Do not enter any passwords, payment details, or personal information. Clear your browser cache and run a full antivirus scan. If you used payment details here, contact your bank immediately to report fraud and cancel affected cards. Save the full URL and any screenshots to report to your national cybercrime unit or platform provider. Stay vigilant—legitimate purchase sites rarely use free domains with hyphenated names and should be verified via official URLs.