thewesternhotels-arena212[.]pages[.]dev

This domain, thewesternhotels-arena212.pages.dev, is identified as an active credential theft infrastructure impersonating hotel booking platforms. Analysis indicates the site mimics legitimate hospitality services to harvest user login credentials, payment details, and personal data. No direct association with cryptocurrency drainer kits or known phishing frameworks has been observed, but the domain exhibits characteristics consistent with credential harvesting campaigns targeting travelers and booking service users. Technical indicators reveal the domain was registered on May 27, 2026, through Cloudflare Pages, a platform frequently leveraged for rapid deployment of phishing sites due to its free hosting and SSL capabilities. VirusTotal detection shows 2 out of 95 security vendors flagging the domain as malicious, suggesting low initial detection rates but confirmed malicious intent. The domain is currently hosted on Cloudflare’s infrastructure, with no public IP address directly exposed, complicating traditional takedown efforts. Google Safe Browsing status is not explicitly listed, but the domain appears on at least one security blocklist, and automated phishing detection systems have already classified it as a threat. As of the latest verification, thewesternhotels-arena212.pages.dev remains active, with no evidence of suspension or mitigation by the hosting provider. The domain’s infrastructure analysis reveals persistent hosting on Cloudflare Pages, a common tactic to evade IP-based blocking. Users are advised to treat any communication or links referencing this domain as malicious, particularly those claiming to offer hotel bookings or exclusive deals. Organizations should update web filters to block the domain and monitor for credential reuse attempts from affected accounts. The remaining risk is assessed as high due to the domain’s active status, low detection rates, and targeting of sensitive personal and financial data.