# ghghgjghj4.pages.dev — SUSPICIOUS > ghghgjghj4.pages.dev is a credential harvesting phishing site that steals user login data. This domain was flagged by just 1 of 95 VirusTotal scanners and. ## Summary PhishDestroy identifies ghghgjghj4.pages.dev as an active credential harvesting phishing domain designed to trick users into entering sensitive login credentials. This Pages.dev subdomain mimics legitimate login portals to siphon credentials, likely targeting unsuspecting victims with fake email or service login forms. This domain was flagged as a generic phishing threat by only 1 out of 95 VirusTotal security vendors, as of the latest scan. Registered through Cloudflare, Inc., it operates with a Google Trust Services SSL certificate for added deception. The domain resolves to IP 172.66.47.126 and remains active at the time of analysis. Users who visited ghghgjghj4.pages.dev should immediately review any credentials they may have entered and change passwords on all affected accounts. Enable multi-factor authentication where possible and scan local devices for malware. Do not re-enter sensitive information on this domain. Report this site to your security team or browser vendor to help block future access. ## Threat Details - Verdict: SUSPICIOUS - Site status: unknown (HTTP ?) ## Domain Intelligence - Registrar: Cloudflare, Inc. - IP: 172.66.47.126 ## Detection Status - VirusTotal: 1 vendors flagged - Google Safe Browsing: clean - Blocklists: 0 hits ## Evidence - Cloudflare Radar: https://radar.cloudflare.com/scan/83d36568-612a-42ca-bbbd-868cda3c393a - PhishDestroy: https://phishdestroy.io/domain/ghghgjghj4.pages.dev/ - LLM endpoint: https://phishdestroy.io/domain/ghghgjghj4.pages.dev/llm.txt ## If You Visited This Site 1. Change any passwords you may have entered 2. Enable 2FA on all related accounts 3. Monitor your accounts for unauthorized activity 4. Report to: FBI IC3, Europol, local authorities --- Report by PhishDestroy | https://phishdestroy.io/domain/ghghgjghj4.pages.dev/ Last updated: 2026-03-22