mravqeni-biz-zormequla-f4x6pc92[.]pages[.]dev

This domain, mravqeni-biz-zormequla-f4x6pc92.pages.dev, is currently active and identified as a fake login portal designed to harvest user credentials. Analysis indicates the infrastructure is being used for generic phishing activities, targeting unsuspecting users through deceptive login interfaces. No specific brand impersonation has been confirmed, but the domain exhibits characteristics consistent with credential theft operations. Infrastructure analysis reveals the domain is registered through Cloudflare, Inc., and resolves to the IP address 172.66.44.100. The SSL certificate is issued by Google Trust Services, which, while legitimate, is commonly exploited by threat actors to lend credibility to malicious sites. VirusTotal detection metrics show that 7 out of 95 security vendors have flagged this domain as malicious, a moderate but concerning indicator of its threat potential. No historical creation date or additional blocklist data is available, suggesting the domain may have been recently deployed or obfuscated to avoid detection. The lack of widespread blocklisting does not diminish the risk, as phishing domains often evade initial detection through rapid deployment and short-lived operations. Current status remains active, and the domain continues to pose a high risk to users who may encounter it through phishing campaigns. Recommendations include immediate blocking of the domain and its associated IP address (172.66.44.100) at the network perimeter. Organizations should also monitor for any internal traffic to this domain, as it may indicate prior compromise or ongoing phishing attempts. Users should be educated on recognizing fake login portals, particularly those hosted on content delivery networks or subdomains of legitimate services. Security teams are advised to correlate this domain with other indicators of compromise, such as related email campaigns or secondary payload delivery mechanisms, to mitigate potential follow-on attacks.