556b6de6[.]pathsss[.]pages[.]dev

Analysis indicates that the domain 556b6de6.pathsss.pages.dev is currently offline but was previously identified as a credential phishing site. The domain was created on September 2 2020 and is hosted behind Cloudflare’s network (AS13335). DNS resolution points to IP 172.66.47.7 located in the United States. The authoritative nameservers adi.ns.cloudflare.com and karl.ns.cloudflare.com confirm the use of Cloudflare’s DNS service. The site presented a HTTP 403 response and the page title returned by the server is “Suspected phishing site | Cloudflare”, which matches the classification of credential phishing.

The SSL certificate is issued by Google Trust Services under the WE1 identifier, indicating a valid TLS handshake despite the malicious intent. Security scoring from Gridinsoft assigned a trust score of 0 out of 100, reflecting extreme risk. Detection engines on VirusTotal flagged the domain in 14 of 93 scans, and Google Safe Browsing categorizes it as social engineering. The domain appears on one public blocklist and was actively blocked by the PhishDestroy sinkhole. Technologies observed include HTTP/3, HSTS, and Cloudflare’s edge services.

The evidence confirms that the infrastructure is deliberately concealed behind a reputable CDN, making direct attribution difficult. Uncertainty remains regarding the underlying payload or credential collection mechanism because no page content beyond the title has been captured. Defenders should block the domain at DNS and proxy layers, add the IP address 172.66.47.7 to network deny lists, and monitor for any future re‑registration or similar sub‑domains under the pathsss.pages.dev namespace. Continuous ingestion of threat‑intel feeds that reference this indicator will help detect resurgence attempts. The high‑risk rating is justified by the combination of low trust score, multiple vendor detections, and the credential‑phishing classification.