# etgrg.pages.dev — SUSPICIOUS

> PhishDestroy flags etgrg.pages.dev as a live credential-harvesting page hosted on Cloudflare Pages. It currently shows 0/95 VirusTotal detections and must be.

## Summary
PhishDestroy identifies etgrg.pages.dev as an active credential-harvesting site under Cloudflare Pages hosting. This domain resolves to 172.66.45.3 and currently shows zero detections on VirusTotal out of 95 engines, indicating a stealthy, recently deployed lure.

The domain was registered through Cloudflare, Inc. and is protected by a Google Trust Services SSL certificate, lending it a deceptive veneer of legitimacy. Given its zero-detection status and deployment on a reputable infrastructure provider, the threat actor is likely iterating quickly to avoid detection while targeting unsuspecting users with spoofed login prompts. The lack of detections suggests this campaign is still in its early stages, making proactive blocking and user awareness critical.

If you visited etgrg.pages.dev, cease any interaction immediately and avoid entering credentials or personal data. Run a full antivirus scan on the device you used to access the site. Report the domain to your security team and consider resetting passwords that may have been exposed, prioritizing accounts used on that device. Enable multi-factor authentication on all critical services to reduce the impact of any potential credential theft.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 172.66.45.3

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/ee66bb29-0356-4f3a-a7d5-654af903da81
- PhishDestroy: https://phishdestroy.io/domain/etgrg.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/etgrg.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/etgrg.pages.dev/
Last updated: 2026-03-28