tobat-pendosa-dijalan-tuhan[.]pages[.]dev

This domain, tobat-pendosa-dijalan-tuhan.pages.dev, is flagged as an active credential harvesting phishing site designed to deceive users into submitting sensitive login credentials. The infrastructure employs a redirect mechanism, as indicated by the page title 'Redirecting...', which is a common tactic to obscure the final phishing destination and evade detection. Such domains are frequently used in campaigns targeting users through malicious links distributed via email, social media, or compromised websites, aiming to capture usernames, passwords, and other authentication details for unauthorized access or financial fraud. Analysis indicates the domain was registered on May 3, 2026, through Cloudflare Pages, a platform often leveraged by threat actors due to its free hosting and SSL capabilities. The domain resolves to the IP address 188.114.97.3, located in Canada and associated with Cloudflare, Inc. infrastructure. Despite its recent creation, the domain has already been added to one security blocklist, though it remains undetected by VirusTotal, with a score of 0/95. The SSL certificate is issued by Let's Encrypt, a legitimate provider, which further complicates detection efforts by blending in with benign traffic. Users who have visited tobat-pendosa-dijalan-tuhan.pages.dev or interacted with any links leading to this domain should take immediate action. First, terminate any active sessions and disconnect from the network to prevent potential data exfiltration. Next, reset credentials for any accounts accessed during or after the visit, prioritizing email, financial, and work-related services. Monitor accounts for unauthorized activity and enable multi-factor authentication where available. If sensitive data was entered, consider reporting the incident to relevant authorities or security teams for further investigation and mitigation.