watersoftenersandfilters-ggvb[.]pages[.]dev

Analysis of the domain watersoftenersandfilters-ggvb.pages.dev shows a recent credential‑phishing infrastructure that was taken offline as of the report date. The domain was registered through Cloudflare on September 19, 2025 and resolves to the Cloudflare‑owned address 172.66.47.147, which is located in the United States under ASN 13335. The TLS certificate presented is issued by Google Trust Services (WE1), and the site enforces HSTS while supporting HTTP/3, confirming that the hosting stack is fully Cloudflare‑managed. A scan on VirusTotal recorded ten detections out of ninety‑five security vendors, and the site is listed on a single public blocklist.

Independent threat‑intel feeds such as PhishDestroy have already blocked the domain, and the page title returned by the server is “Suspected phishing site | Cloudflare”, indicating that the site now serves Cloudflare’s default block page with an HTTP 403 status. Gridinsoft’s trust score of zero further reinforces the malicious classification. The available intelligence confirms a credential‑phishing motive but does not reveal the specific brand or login portal being impersonated, nor does it provide a snapshot of the malicious page content. Consequently, the exact phishing vector and any associated payload remain uncertain.

Defenders should continue to deny any network traffic to the domain and its IP address, add the host to local and perimeter blocklists, and monitor for any re‑registration or reuse of the same sub‑domain pattern. Because the infrastructure is hosted on Cloudflare, threat‑hunters should also watch for other domains that share the same nameserver pair (ines.ns.cloudflare.com, jonah.ns.cloudflare.com) or that resolve to the same IP range, as they may indicate a broader campaign. Ongoing collection of URL‑level indicators and any future content captures will be necessary to refine detection rules and to assess whether the phishing operation is part of a larger threat actor’s toolkit.