zrfsub[.]pages[.]dev

PhishDestroy identifies zrfsub.pages.dev as an active Social Security phishing domain currently under investigation for fraudulent activity. This domain, hosted on Cloudflare Pages, is being monitored for potential impersonation of official U.S. Social Security Administration (SSA) portals. The threat remains classified as a generic phishing campaign due to unresolved verification of impersonated entities and operational intent. Users are advised to exercise caution when encountering this domain, as it may be used to harvest sensitive personal and financial information under false pretenses.

This domain was flagged by 0 of 95 VirusTotal vendors as of the latest scan, indicating a delay in detection system recognition despite its active status. It resolves to IP 172.66.47.143 via Cloudflare, Inc., with a Let's Encrypt SSL certificate for HTTPS obfuscation. The domain is part of Cloudflare's Pages platform, leveraging legitimate infrastructure to evade traditional blacklisting. No blocklist entries or trust scores are currently available, leaving users and organizations vulnerable to unchecked exposure. The lack of detections suggests a newly emerged or stealthily operated campaign relying on Cloudflare's reputation to bypass initial scrutiny.

Given the active threat status and absence of vendor detections, immediate precautionary measures are recommended. Users should avoid accessing zrfsub.pages.dev and report any instances of encountering this domain to their security teams or relevant authorities. Organizations are advised to update firewall rules and DNS blocklists to preemptively block traffic to this IP (172.66.47.143) and associated domains. Cloudflare Pages users should audit their domains for unauthorized subdomains and enable strict verification protocols. Continuous monitoring via threat intelligence feeds is critical to mitigate potential data breaches or credential harvesting attacks linked to this domain.