updaten-factory[.]pages[.]dev

This domain, updaten-factory.pages.dev, is flagged as an active credential phishing site targeting Microsoft 365 users. Analysis indicates the infrastructure mimics enterprise login portals, likely using a lightweight phishing kit to harvest corporate credentials. No specific brand impersonation or drainer kit signatures have been identified at this stage, though the domain structure suggests a focus on business email compromise scenarios. Infrastructure analysis reveals the domain resolves to IP address 172.66.47.73 with zero detections across 95 security engines on VirusTotal. Registered through Cloudflare's registrar service, the domain currently maintains an active SSL certificate issued by Google Trust Services. Creation date metadata is unavailable, and Google Safe Browsing has not yet flagged the domain. No blocklist entries exist across major threat intelligence platforms as of the latest scan. The domain remains operational with no takedown actions observed. Response actions should include immediate URL blocklisting, monitoring of associated IP ranges, and alerting of potentially targeted organizations. Remaining risk is elevated due to the domain's clean detection profile and use of legitimate hosting infrastructure, which may delay automated detection. Security teams are advised to treat any login attempts originating from this domain as compromised credentials and initiate password reset protocols for affected accounts.