gfffngbrhas1lltrimaajtt[.]pages[.]dev

This domain, gfffngbrhas1lltrimaajtt.pages.dev, operates as a credential harvesting phishing site designed to steal user login credentials. Analysis indicates the infrastructure presents fraudulent login portals mimicking legitimate services, tricking visitors into entering sensitive information such as usernames, passwords, and potentially multi-factor authentication codes. The threat primarily targets individuals through deceptive emails, messages, or malicious advertisements directing users to the fraudulent page. Infrastructure analysis reveals the domain was registered on June 15, 2025, through Cloudflare, Inc., and resolves to the IP address 188.114.96.3, hosted within AS13335. The SSL certificate is issued by Google Trust Services (WE1), a common practice among phishing sites to appear legitimate. Security vendor detections on VirusTotal show 17 out of 95 engines flagging the domain as malicious, with one security blocklist listing confirming its elevated risk status. The domain has since been taken offline, though similar threats may persist. Individuals who visited gfffngbrhas1lltrimaajtt.pages.dev should immediately revoke any entered credentials from associated accounts. Reset passwords using a secure device and enable multi-factor authentication where available. Monitor accounts for unauthorized activity and report any suspicious transactions. If personal or financial data was submitted, consider placing a fraud alert with relevant institutions. Avoid interacting with unsolicited links or messages, and verify the legitimacy of any login portal before entering credentials.