customer-sp-alexk[.]pages[.]dev

This domain, customer-sp-alexk.pages.dev, is identified as a credential theft operation designed to harvest user login credentials through deceptive login portals. Analysis indicates the site impersonates legitimate authentication interfaces, likely targeting corporate or financial service users to capture usernames, passwords, and multi-factor authentication tokens. The infrastructure is optimized for rapid deployment and evasion, with cloned templates that closely resemble trusted platforms, increasing the likelihood of successful compromise. Infrastructure analysis reveals concrete indicators of malicious activity. The domain was registered through Cloudflare, Inc. on May 15, 2026, an anomalous creation date suggesting potential domain spoofing or misuse of registration systems. It resolves to IP address 172.66.44.59, located in California and associated with Cloudflare's network. Security vendors on VirusTotal flag the domain at 18/95, while it appears on one additional blocklist. The SSL certificate, issued by Google Trust Services (WE1), provides encrypted connections to lend false legitimacy to the phishing interface. Users who visited customer-sp-alexk.pages.dev should immediately revoke any entered credentials and monitor associated accounts for unauthorized access. If login details were submitted, reset passwords for all potentially compromised services, prioritizing financial, email, and corporate accounts. Enable multi-factor authentication where available, using app-based or hardware tokens rather than SMS-based methods. Examine recent account activity for anomalies, such as unrecognized logins or transactions, and report suspicious events to the affected service providers. Organizations should block the domain and IP at the network perimeter to prevent further exposure.