affsite-xyz[.]pages[.]dev

This domain, affsite-xyz.pages.dev, is identified as an active phishing infrastructure designed to deploy fake login pages. Analysis indicates it targets users by impersonating authentication portals, likely leveraging social engineering to harvest credentials. No specific brand impersonation or cryptocurrency drainer kit signatures have been confirmed, but the domain’s structure and hosting pattern align with credential theft campaigns. The absence of a known brand tie suggests a generic or opportunistic phishing operation rather than a targeted impersonation effort. Infrastructure analysis reveals the following technical indicators: the domain was registered on March 26, 2026, through Cloudflare Pages, a platform frequently abused for rapid deployment of phishing sites due to its free hosting and automatic SSL certificates. VirusTotal detection shows 1 out of 95 security vendors flagging the domain as malicious, a low but non-zero signal that warrants caution. The domain appears on one security blocklist, and Google Safe Browsing (GSB) status remains unconfirmed at this time. No associated IP address has been publicly attributed, likely due to Cloudflare’s proxy services masking the origin server. Current status remains active, with no evidence of takedown or mitigation. The domain’s persistence and low detection rate suggest it may still be in the early stages of deployment or evading automated detection through obfuscation techniques. Users are advised to treat any interaction with this domain as high-risk, particularly if prompted for login credentials or personal information. Organizations should block the domain at the network level and monitor for related indicators of compromise, such as unusual authentication attempts or outbound connections to the domain. Given the registrar’s role in hosting, further abuse reports may be necessary to disrupt the infrastructure.