sso-logi-coen[.]pages[.]dev

This domain, sso-logi-coen.pages.dev, is flagged as a credential harvesting phishing site designed to mimic legitimate single sign-on (SSO) portals. Analysis indicates the infrastructure was specifically engineered to deceive users into submitting corporate or personal login credentials through cloned authentication interfaces, likely targeting enterprise environments or cloud service users. The domain employs realistic subdomain naming conventions (e.g., 'sso-logi') to increase plausibility and bypass initial user scrutiny. Infrastructure analysis reveals the domain was registered on October 08, 2025, through Cloudflare, Inc., and currently resolves to the IP address 172.66.44.90, associated with Cloudflare’s Anycast network (AS13335). Security vendor detection on VirusTotal stands at 15/95, with the domain appearing on at least one security blocklist. The SSL certificate, issued by Google Trust Services (WE1), provides encrypted connections to the phishing page, further obscuring malicious intent. The page title, 'Suspected phishing site | Cloudflare,' suggests automated detection by the hosting provider, though the domain remained operational long enough to pose a credible threat. Users who visited sso-logi-coen.pages.dev should immediately revoke any entered credentials, particularly those associated with corporate or cloud-based accounts. Monitor linked accounts for unauthorized access or anomalous activity, and reset passwords using multi-factor authentication where available. Organizations should review logs for connections to 172.66.44.90 or the domain itself, and update endpoint protection rules to block the domain and associated IP. If credentials were submitted, assume compromise and initiate incident response protocols, including password resets and account audits.