business-blue-tick-confirmed-000022026[.]pages[.]dev

The domain business-blue-tick-confirmed-000022026.pages.dev is currently flagged as an active credential theft phishing campaign. Analysis indicates this infrastructure is designed to harvest user login credentials, likely targeting corporate or financial service accounts. The domain remains operational and poses a high risk to unsuspecting users. Infrastructure analysis reveals the domain is registered through Cloudflare, Inc., and resolves to the IP address 172.66.47.170. As of the latest assessment, the domain is detected by 9 of 95 security vendors on VirusTotal, indicating a moderate but growing level of recognition within threat intelligence communities. No historical registration data is publicly available, suggesting recent deployment or deliberate obfuscation of creation timestamps. The use of Cloudflare’s hosting and registrar services provides the threat actor with enhanced anonymity and resilience against takedown efforts. Current status confirms the domain remains active, with no indications of remediation or disruption. Organizations and individuals are advised to block the domain and associated IP address at the network perimeter. Endpoint protection systems should be updated to include this indicator of compromise. Users are urged to verify the legitimacy of any communication or login prompts originating from this domain, particularly those requesting sensitive credentials. Security teams should monitor for related phishing attempts leveraging similar naming conventions or infrastructure patterns.