# echo-app-a2j.pages.dev — SUSPICIOUS

> echo-app-a2j.pages.dev is a brand-new Cloudflare Pages site that is actively probing for user credentials, hosting a fake login form that mimics popular.

## Summary
PhishDestroy identifies echo-app-a2j.pages.dev as an active credential-harvesting probe under investigation at risk level under_investigation. The site presents itself as a legitimate login interface while exfiltrating entered credentials to unauthorized third parties.  The domain points to IP 188.114.97.3, is registered through Cloudflare, Inc., and secured with a Let’s Encrypt SSL certificate. VirusTotal currently records 0/95 antivirus engines detecting malicious content; no public blocklist entries or trust-score penalties have yet been logged. The site leverages Cloudflare Pages to blend with benign hosting infrastructure, complicating early detection.  Users who encounter echo-app-a2j.pages.dev should immediately refrain from entering any credentials, close the tab, clear cached credentials for the targeted service, and update passwords using a different device or network. If credentials were already entered, revoke access in the legitimate service account settings, enable two-factor authentication, and scan local devices for malware. Administrators should block 188.114.97.3 at the firewall and report the domain to Cloudflare’s abuse portal to accelerate takedown.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 188.114.97.3

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/domains/echo-app-a2j.pages.dev
- PhishDestroy: https://phishdestroy.io/domain/echo-app-a2j.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/echo-app-a2j.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/echo-app-a2j.pages.dev/
Last updated: 2026-04-04