r3b31z[.]pages[.]dev

This domain, r3b31z.pages.dev, is flagged as a credential harvesting phishing site designed to mimic legitimate login portals. Analysis indicates the infrastructure was configured to deceive users into submitting sensitive credentials, likely through cloned authentication interfaces. No specific brand impersonation or drainer kit signatures have been confirmed at this stage, though the domain structure and hosting pattern align with known phishing campaigns leveraging Cloudflare Pages for rapid deployment and evasion. Infrastructure analysis reveals the domain resolves to IP address 172.66.47.153, a Cloudflare-hosted endpoint. The domain was registered on March 31, 2026, through Cloudflare, Inc., and currently holds a VirusTotal detection score of 0/95, indicating no antivirus engines have flagged it as malicious. The SSL certificate is issued by Google Trust Services, providing encrypted connections to avoid immediate browser warnings. Gridinsoft’s trust score for the domain stands at 0/100, reflecting high suspicion. The domain appears on one security blocklist and is actively blocked by PhishDestroy, suggesting prior detection by automated fraud monitoring systems. The domain is currently offline, having been taken down following initial detection. Response actions included Cloudflare’s enforcement of a warning page titled 'Suspected phishing site,' effectively neutralizing the immediate threat. Despite the takedown, residual risk remains due to the domain’s recent creation date and lack of prior detections, which may allow it to re-emerge under altered infrastructure. Users and organizations are advised to monitor for similar patterns, particularly domains hosted on Cloudflare Pages with anomalous creation dates or low detection scores, and to implement real-time blocklist integration for enhanced protection.