logindewatogel[.]pages[.]dev

The domain logindewatogel.pages.dev was observed serving an HTTP 200 response with the page title "DEWATOGEL : Login Situs Toto Cepat di Link Alternatif Terbaru 2026". Analysis classifies the site as a credential‑phishing operation targeting users of the DEWATOGEL service, and the risk level is assigned as high. Infrastructure data shows the domain resolves to IP address 172.66.44.247 and is hosted on Cloudflare Pages, indicating the use of a legitimate hosting provider to obscure ownership. The domain appears on one external security blocklist and is actively blocked by PhishDestroy, confirming that at least one trusted feed has flagged it. VirusTotal scans returned detections from 2 of 95 security vendors, providing additional evidence of malicious intent. The current status is active, meaning the phishing page is still reachable. No further technical details about the login form, credential collection method, or associated command‑and‑control infrastructure have been disclosed, leaving those aspects uncertain. Defenders should add logindewatogel.pages.dev to URL filtering and DNS block lists, monitor outbound connections for attempts to resolve the IP 172.66.44.247, and consider updating intrusion‑detection signatures to capture similar Cloudflare‑Pages‑hosted phishing pages. Continuous observation is advised to detect any evolution of the campaign or emergence of additional indicators.