mashalaump[.]pages[.]dev

PhishDestroy identifies mashalaump.pages.dev as an active credential theft campaign targeting unsuspecting users. The domain leverages a Cloudflare-registered subdomain under pages.dev to host spoofed login portals, aiming to harvest credentials under the guise of legitimate authentication flows. Given its recent registration and lack of detection coverage, this threat exhibits high evasion potential and poses a significant risk to users engaging with untrusted links.

This domain was flagged with a status of active and a risk level under investigation (seed 062c68). Intelligence confirms VirusTotal detections at 1/95 as of the latest scan, no blocklist inclusions, registration through Cloudflare, Inc., resolution to IP 188.114.97.3 via Let’s Encrypt SSL, and infrastructure hosted on Cloudflare Pages. The subdomain structure and use of a reputable CDN suggest an attempt to bypass traditional security filters by blending into trusted web services.

Users are advised to immediately block mashalaump.pages.dev at the network level and avoid interacting with any login prompts originating from this domain. Organizations should update email security policies to flag Cloudflare Pages subdomains associated with suspicious keywords or low-reputation domains. For credential theft mitigation, enable multi-factor authentication across all accounts and educate users on verifying domain legitimacy through official channels.