quqoin-login[.]pages[.]dev

PhishDestroy identifies quqoin-login.pages.dev as an active credential phishing domain designed to impersonate a Google login portal. The domain is currently under investigation for hosting deceptive login pages intended to harvest user credentials under false pretenses. Analysis indicates this is part of a broader campaign targeting unsuspecting users through Cloudflare Pages.

This domain was flagged by 10 of 95 VirusTotal vendors, exhibits a Google Trust Services SSL certificate, resolves to IP address 188.114.96.3, and is registered through Cloudflare, Inc. The domain has not been reported on any significant blocklists and maintains neutral trust scores across available threat intelligence platforms. The absence of detections suggests either recent deployment or evasion tactics designed to bypass initial scanning phases.

As this threat remains active, users are strongly advised to avoid interacting with quqoin-login.pages.dev or entering any credentials. Organizations should monitor network traffic for connections to the associated IP address (188.114.96.3) and consider blocking the domain at the network perimeter. If credentials have been entered, users should immediately reset passwords and enable multi-factor authentication on all accounts where the credentials were reused. This domain should be treated as high-risk until further investigation confirms its takedown or remediation.