m-columbiaml-co[.]pages[.]dev

This domain, m-columbiaml-co.pages.dev, is actively engaged in credential harvesting phishing operations targeting users through deceptive login interfaces. Analysis indicates the site mimics legitimate authentication portals to capture sensitive credentials, including usernames, passwords, and potentially multi-factor authentication codes. The page title 'COLUM' suggests an attempt to impersonate a trusted entity, likely leveraging typographical similarity or branding deception to increase success rates. Infrastructure analysis reveals the domain was registered on March 30, 2026, through Cloudflare, Inc., and resolves to the IP address 188.114.97.3, hosted within Cloudflare’s network in Canada. As of the latest scan, the domain has zero detections out of 95 engines on VirusTotal, indicating either recent deployment or evasion techniques. However, it appears on one security blocklist, suggesting prior malicious activity has been detected by at least one threat intelligence source. The SSL certificate is issued by Let’s Encrypt, providing encrypted communication to lend an appearance of legitimacy. Users who have visited m-columbiaml-co.pages.dev or entered credentials on the site should immediately revoke and reset any exposed passwords, particularly for accounts associated with the impersonated entity. Enable multi-factor authentication where available to mitigate unauthorized access. Monitor linked accounts for suspicious activity, including unauthorized logins or transactions. Network administrators should block the domain and its resolving IP address (188.114.97.3) at the perimeter to prevent further exposure. If credentials were submitted, assume they are compromised and take corrective action across all platforms where the same credentials may have been reused.