mera-mask-start-logn[.]pages[.]dev

PhishDestroy identifies mera-mask-start-logn.pages.dev as a brand impersonation domain currently under active investigation for credential theft. This Cloudflare Pages site masquerades as a legitimate service to harvest user login data, posing a direct risk to unsuspecting visitors. The domain is not yet flagged on VirusTotal (0/95 engines) despite its malicious intent, indicating a newly deployed threat with low detection coverage. This domain was flagged through PhishDestroy’s seed 0fe740 with the following indicators: registered via Cloudflare, Inc., resolving to IP 188.114.96.3, and secured with a Google Trust Services SSL certificate. VirusTotal analysis shows 0 detections out of 95 scanners as of the latest scan, while the domain remains unlisted on major blocklists such as Google Safe Browsing and PhishTank. The use of a Cloudflare Pages subdomain and trusted SSL certificate suggests an attempt to evade detection by leveraging reputable infrastructure. Mitigation for this credential theft threat includes blocking the domain at the network level and avoiding any interaction with the page. Users should verify the legitimacy of websites by checking official domains and enabling multi-factor authentication on all accounts. Report the domain to your security team or via PhishDestroy’s portal to prevent further propagation. Immediate action is advised due to the active nature of this campaign.