webpage-bridge[.]pages[.]dev

PhishDestroy identifies webpage-bridge.pages.dev as an active fake login portal phishing domain under investigation. This domain is currently categorized as a generic phishing threat, with no detections on VirusTotal as of the latest scan (10/95 engines). The domain resolves to IP 188.114.97.3 and is registered through Cloudflare, Inc., leveraging Google Trust Services for its SSL certificate. No listings on known blocklists or trust score evaluations have been recorded at this time, indicating a newly emerged or stealthily operated threat.

Technical indicators reveal a phishing campaign designed to mimic legitimate login interfaces, exploiting the reputation of Cloudflare Pages and Google Trust Services to deceive users. The domain’s association with pages.dev suggests an attempt to impersonate official Cloudflare-hosted content, while the absence of detections on VirusTotal highlights the challenge of early-stage detection for such threats. The IP address (188.114.97.3) is linked to Cloudflare’s infrastructure, further complicating attribution. As of now, no creation date or historical data is publicly available, reinforcing the need for proactive monitoring.

To mitigate risks associated with this fake login portal phishing domain, users should avoid interacting with suspicious links and verify the legitimacy of login pages before entering credentials. Organizations are advised to implement email filtering rules targeting domains hosted on pages.dev, particularly those with no prior reputation. Additionally, enabling multi-factor authentication (MFA) can reduce the impact of credential theft. Security teams should monitor for connections to IP 188.114.97.3 and blocklist the domain upon confirmation of malicious activity. Continuous threat intelligence updates are critical to track this evolving phishing campaign.