sphinx-retread-g-app-d-cc[.]pages[.]dev

The domain sphinx-retread-g-app-d-cc is assessed as a high-risk domain primarily flagged for credential theft. The domain's intent is to deceive users into revealing sensitive information such as usernames, passwords, and other personal data.

Analysis indicates that the domain was created on June 09, 2026, and is currently registered through Cloudflare Pages. Resolving to the IP address 188.114.96.3, the domain has been flagged by 2 out of 95 security vendors on VirusTotal, suggesting a low but significant level of suspicion. The domain appears on 3 security blocklists, including PhishDestroy and SEAL, which further corroborate the credential theft threat. The SSL certificate is issued by Google Trust Services, which may lend a false sense of security to unsuspecting users. The page title 'Mog Coin' suggests an attempt to impersonate a legitimate cryptocurrency brand, potentially leading users to believe they are interacting with a trusted service.

To mitigate the risks associated with this domain, it is recommended that users avoid clicking on any links or providing personal information on the website. Security teams should block the domain at the network level and add it to their threat intelligence feeds. Additionally, users should be educated on recognizing phishing attempts and the importance of verifying the URL and SSL certificate before entering any sensitive information. Regular updates to security software and browser extensions can also help in detecting and blocking such malicious sites.