# sol-scope-icu-e102c9.pages.dev — SUSPICIOUS

> sol-scope-icu-e102c9.pages.dev is a generic phishing domain impersonating a login page. Security analysts report 0/95 VirusTotal detections.

## Summary
PhishDestroy identifies sol-scope-icu-e102c9.pages.dev as a generic phishing domain currently active in the wild. The domain is configured to mimic a credential harvesting interface, likely targeting unsuspecting users under the guise of a legitimate service. No specific brand or drainer kit attribution is available at this time, suggesting a generic or newly deployed campaign using off-the-shelf phishing toolkits. The infrastructure relies on Cloudflare Pages for hosting, which is a common tactic among phishing operators to evade detection and prolong uptime. The domain does not appear to be associated with a known organization or service, reducing the likelihood of direct brand impersonation but increasing the risk of indiscriminate targeting.  

 This domain was flagged with a VirusTotal detection ratio of 0/95, indicating that none of the 95 participating security vendors have yet identified the threat. It resolves to IP address 172.66.47.56, which is part of Cloudflare’s edge network, further complicating direct takedown efforts. The domain is registered through Cloudflare, Inc., leveraging their privacy-protected registration services to obscure ownership details. The SSL certificate is issued by Google Trust Services, which is expected given Cloudflare’s use of Google Trust Services for TLS termination. As of the latest analysis, the domain remains active and has not been listed on major blocklists, including Google Safe Browsing or PhishTank, at the time of detection.  

 The current status of sol-scope-icu-e102c9.pages.dev is active, with an under investigation risk level assigned due to the absence of detections and limited telemetry. Security researchers are urged to monitor this domain closely, as its low initial detection rate may rise as threat intelligence spreads. Organizations and end-users are strongly advised to avoid interacting with this domain, especially any pages requesting login credentials or personal information. Implementing network-level blocking for the IP address 172.66.47.56 and domain name sol-scope-icu-e102c9.pages.dev is recommended. Given the lack of detections and active status, the risk remains high for credential theft until further remediation or takedown occurs. Users who may have already entered sensitive information should immediately change passwords and enable multi-factor authentication on all affected accounts.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 172.66.47.56

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/937798ed-0a6a-4b99-be0a-8df3556cd8aa
- PhishDestroy: https://phishdestroy.io/domain/sol-scope-icu-e102c9.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/sol-scope-icu-e102c9.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/sol-scope-icu-e102c9.pages.dev/
Last updated: 2026-04-12