faq-rayiidum-swape[.]pages[.]dev

PhishDestroy identifies faq-rayiidum-swape.pages.dev as an active generic phishing domain designed to deceive users into divulging sensitive information under the guise of a legitimate swap service. This domain leverages Cloudflare Pages hosting and a Google Trust Services SSL certificate to appear authentic, exploiting trust in well-known infrastructure providers to mask its malicious intent. The threat actor behind this campaign may harvest credentials, payment details, or personal data entered into fraudulent forms, potentially leading to financial loss or identity theft. This domain was flagged as active with a risk level of under_investigation, currently evading detection with a clean status of 0 detections out of 95 on VirusTotal. It is registered through Cloudflare, Inc. and resolves to the IP address 188.114.96.3, a range known for hosting dynamic and potentially malicious content. The use of Cloudflare Pages allows threat actors to rapidly deploy and rotate domains, while the Google Trust Services certificate adds a veneer of legitimacy to phishing lures. Despite its current evasion of antivirus engines, the domain’s behavior and infrastructure align with known phishing tactics, warranting heightened caution from users. If you have visited faq-rayiidum-swape.pages.dev, cease all interaction with the site immediately and do not enter any credentials or personal information. Review your accounts for suspicious activity, particularly financial transactions or unauthorized access attempts. Report the domain to your security team or platform providers, such as Google Safe Browsing, to aid in blocking efforts. Use a reputable password manager to change exposed credentials securely, and consider enabling multi-factor authentication on critical accounts to mitigate potential compromise. Monitor your credit reports and financial statements for signs of misuse, and remain vigilant for follow-on phishing attempts leveraging stolen data.