account-recovery-center[.]pages[.]dev

This domain, account-recovery-center.pages.dev, is identified as a high-risk credential phishing site designed to harvest user login credentials. Analysis indicates the page mimics legitimate account recovery portals, likely targeting users attempting to regain access to compromised services. No specific brand impersonation or crypto drainer kit signatures were detected, but the domain structure and content align with credential theft campaigns. The site does not appear to deploy advanced evasion techniques beyond standard phishing templates. Infrastructure analysis reveals the domain was registered on September 14, 2025, through Cloudflare, Inc., and resolves to the IP address 188.114.96.3. It is flagged by 18 out of 95 security vendors on VirusTotal, with Google Safe Browsing classifying it under SOCIAL_ENGINEERING. The domain appears on two security blocklists and is associated with an SSL certificate issued by Google Trust Services. Technologies detected include HSTS, Cloudflare CDN, and HTTP/3, suggesting an attempt to appear legitimate while leveraging modern web protocols. As of the latest assessment, the domain has been taken offline, and its page title now displays 'Suspected phishing site | Cloudflare.' It is blocked by multiple threat intelligence feeds, including PhishDestroy and OISD. Despite its current offline status, residual risk remains due to potential re-registration or reuse of the infrastructure. Organizations are advised to monitor for related domains, enforce blocklisting of the IP and domain, and educate users on recognizing credential phishing attempts. SSL inspection and real-time domain reputation checks are recommended to mitigate similar threats.