perno-galix-trima[.]pages[.]dev

This domain is flagged as a credential harvesting phishing site targeting users through deceptive login interfaces. Analysis indicates the infrastructure was designed to impersonate legitimate services, likely to capture sensitive authentication details such as usernames, passwords, and multi-factor authentication codes. The risk level is classified as elevated due to its active distribution and confirmed malicious intent prior to takedown. Infrastructure analysis reveals the domain perno-galix-trima.pages.dev was registered through Cloudflare, Inc. and resolved to the IP address 188.114.97.3, associated with AS13335 (Cloudflare, Inc.) in the United States. The domain was created on November 19, 2025, and is currently offline. Security vendors on VirusTotal detected the domain, with 17 out of 95 flagging it as malicious. The SSL certificate is issued by Google Trust Services (WE1), a common attribute in phishing campaigns leveraging legitimate certificate authorities. The domain appears on two security blocklists: PhishDestroy and PhishingDB. The page title, 'Suspected phishing site | Cloudflare,' further corroborates its malicious classification. Mitigation steps for this threat include blocking the domain and its associated IP (188.114.97.3) at the network perimeter. Organizations should update endpoint protection rules to detect and prevent access to this domain and similar Cloudflare-hosted phishing pages. Security teams are advised to monitor for indicators of compromise, such as unusual login attempts or credentials submitted to this domain prior to its takedown. User awareness training should emphasize the risks of credential harvesting attacks, particularly those hosted on seemingly legitimate cloud infrastructure. If credentials were entered on this site, immediate password resets and multi-factor authentication reviews are recommended for affected accounts.