gondor[.]pages[.]dev

This domain, gondor.pages.dev, is currently flagged as an active credential theft phishing site. Analysis indicates the infrastructure is designed to harvest user login credentials through deceptive login portals, likely targeting unsuspecting victims via social engineering tactics. The domain remains operational as of the latest verification, posing a continued risk to end-users. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on February 21, 2026, and resolves to the IP address 172.66.46.225, associated with AS13335 (Cloudflare, Inc.) in the United States. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of phishing domains leveraging reputable certificate authorities to appear legitimate. Detection metrics show the domain is flagged by 2 of 95 security vendors on VirusTotal and appears on two independent security blocklists. Additional monitoring systems, including PhishDestroy and ScamSniffer, have classified this domain as malicious, further corroborating its fraudulent nature. The current risk assessment categorizes gondor.pages.dev as high severity due to its active status, credential harvesting capabilities, and minimal detection coverage. Organizations and individuals are advised to implement immediate network-level blocking for the domain and its associated IP (172.66.46.225). End-users should be educated on recognizing phishing indicators, such as mismatched URLs, unsolicited login requests, and SSL certificate anomalies. Security teams are recommended to monitor for related domains registered under the same infrastructure or registrar, as threat actors frequently rotate domains to evade detection.