tusqa5-2lirvo[.]pages[.]dev

This domain is flagged as a credential theft operation designed to harvest user login credentials through deceptive login portals. Analysis indicates the site mimics legitimate authentication pages, tricking visitors into entering usernames, passwords, and potentially multi-factor authentication codes. The infrastructure is structured to exfiltrate captured data to attacker-controlled endpoints, enabling account takeovers and unauthorized access to sensitive systems. Infrastructure analysis reveals the domain tusqa5-2lirvo.pages.dev was registered through Cloudflare, Inc. on February 04, 2026, and resolves to the IP address 172.66.47.106, hosted on AS13335 in the United States. Security vendors on VirusTotal flag the domain at 18/95, while it appears on one additional blocklist. The SSL certificate is issued by Google Trust Services (WE1), a common feature in both legitimate and malicious Cloudflare-hosted sites. The page title, 'Suspected phishing site | Cloudflare,' suggests automated detection by the hosting provider prior to takedown. Users who visited tusqa5-2lirvo.pages.dev should assume their credentials were compromised. Immediate action is required: reset passwords for any accounts entered on the site, enable multi-factor authentication where available, and monitor linked accounts for unauthorized activity. Review recent login attempts and revoke access from unfamiliar devices or locations. If financial or sensitive data was exposed, consider placing fraud alerts on credit files and reporting the incident to relevant authorities. Browser-based password managers may have auto-filled credentials; audit stored entries for signs of tampering.