vidyastationery-portfolio[.]pages[.]dev

PhishDestroy identifies vidyastationery-portfolio.pages.dev as an active credential phishing page currently under investigation for impersonation attempts. This domain is leveraging a Cloudflare Pages-hosted site to deceive visitors into divulging sensitive credentials under the guise of a legitimate stationery portfolio. The threat remains active as of the latest assessment, with threat actors continually refining delivery vectors to maximize deception.

This domain was flagged by 0 of 95 VirusTotal threat detection vendors at the time of analysis, indicating a low initial detection rate despite its malicious behavior. Registered through Cloudflare, Inc., it resolves to IP address 172.66.45.33 and utilizes a Let's Encrypt SSL certificate to enhance perceived legitimacy. The infrastructure’s reliance on Cloudflare Pages and Cloudflare DNS services highlights a deliberate attempt to evade scrutiny by leveraging reputable hosting and networking providers.

Given its active credential harvesting operation and negligible detection coverage, PhishDestroy recommends immediate blacklisting of vidyastationery-portfolio.pages.dev at the network perimeter. Users should avoid interaction entirely and report the domain to their security teams or through official phishing reporting channels. Organizations are advised to implement blocking rules for the resolving IP (172.66.45.33) and monitor for related infrastructure lateral movement. Continuous monitoring of emerging variants and infrastructure pivots is critical to prevent downstream compromise stemming from credential theft.