logn-mtamsk-secure[.]pages[.]dev

The domain logn-mtamsk-secure.pages.dev was identified as a credential phishing site targeting users through fraudulent login portals. Analysis confirms the domain was designed to harvest authentication credentials, though no specific brand impersonation was conclusively determined. The domain is currently offline, but prior activity aligns with high-risk phishing campaigns observed in recent threat landscapes.

Technical indicators reveal the domain was flagged by 14 of 95 security vendors on VirusTotal, with additional detections on one security blocklist. Infrastructure analysis shows the domain was registered through Cloudflare, Inc. on October 28, 2025, and resolved to the IPv6 address 2a06:98c1:3121::3, associated with AS13335. The SSL certificate was issued by Google Trust Services (WE1), a common tactic to lend legitimacy to malicious domains. Google Safe Browsing also classified the domain as phishing, reinforcing its malicious intent.

While the domain is currently offline, residual risk remains due to potential reuse of the infrastructure or re-registration under a similar name. Organizations are advised to block the domain and its associated IP address at the perimeter. Endpoint protection systems should be updated to include the domain in deny lists, and users should be educated on recognizing phishing attempts, particularly those leveraging cloud-based hosting services. Monitoring for related domains with similar naming patterns (e.g., variations of 'mtamsk') is recommended to preempt further threats.