# sfffuff.pages.dev — SUSPICIOUS

> Beware the fake Brawl Stars Mechmas Event at sfffuff.pages.dev — a phishing domain with 0/95 VirusTotal detections that steals user credentials.

## Summary
PhishDestroy identifies sfffuff.pages.dev as a live phishing domain masquerading as the Brawl Stars Mechmas Event, luring users into credential theft under Cloudflare Pages hosting. This domain was flagged with a generic phishing threat vector, leveraging a spoofed gaming event to harvest login details in what appears to be a draener-style campaign targeting mobile gamers. The lure closely mimics Supercell’s event branding to maximize click-through rates while remaining undetected by security engines.  

Technical indicators confirm this domain resolves to IP 188.114.96.3 and is registered via Cloudflare, Inc., with a Google Trust Services SSL certificate. VirusTotal currently shows 0/95 detections, indicating zero detection coverage as of this advisory. While the exact registration date remains unverified, the domain remains active and unlisted by Google Safe Browsing. A scan across open threat intelligence feeds reveals no prior blocklist entries, suggesting a newly deployed campaign with minimal historical footprint.  

This domain is currently active and under active monitoring by PhishDestroy. Users are strongly advised to block sfffuff.pages.dev at the network perimeter and avoid accessing the link entirely. The lack of VirusTotal detections and absence from blocklists elevate the risk of successful user compromise. Security teams should implement DNS sinkholing for this domain and monitor for associated credential dumps on dark web channels. Remaining risk is classified as elevated due to undetected status and active lure.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: alive (HTTP ?)
- Page title: BRAWL STARS MECHMAS EVENT

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 188.114.96.3

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/82e99566-9016-412d-8869-30195224d833
- PhishDestroy: https://phishdestroy.io/domain/sfffuff.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/sfffuff.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/sfffuff.pages.dev/
Last updated: 2026-04-12