f-a-g-trust[.]pages[.]dev

This domain, f-a-g-trust.pages.dev, is identified as a credential harvesting phishing site designed to mimic legitimate authentication portals. Analysis indicates its primary objective is the unauthorized collection of user credentials, including usernames, passwords, and potentially multi-factor authentication codes, through fraudulent login interfaces. The site employs social engineering tactics to deceive visitors into submitting sensitive information, which can then be exploited for account takeovers or further malicious activities. Infrastructure analysis reveals multiple technical indicators supporting this classification. The domain was registered on September 19, 2025, through a hosting provider and resolves to the IP address 188.114.96.3. It is flagged by 4 out of 95 security vendors on VirusTotal and appears on three independent security blocklists. The domain uses a SSL certificate issued by Google Trust Services and is served via a content delivery network, leveraging technologies such as HSTS and HTTP/3 to enhance perceived legitimacy. The page title, 'Suspected phishing site | Cloudflare,' suggests automated detection by the hosting platform prior to takedown. Users who visited f-a-g-trust.pages.dev or entered credentials on the site should assume their authentication data has been compromised. Immediate steps include changing passwords for any accounts accessed or replicated on the phishing site, enabling multi-factor authentication where available, and monitoring affected accounts for unauthorized activity. System scans using updated security tools are recommended to detect potential secondary infections. Organizations should review access logs for connections to 188.114.96.3 and the domain itself, and consider implementing network-level blocks to prevent further exposure.