gadyahjd[.]pages[.]dev

PhishDestroy has identified gadyahjd.pages.dev as a recently activated phishing domain posing an active threat to unsuspecting users. While hosted on Cloudflare Pages (via Cloudflare, Inc.) and resolving to IP 188.114.96.3, this domain leverages a Let’s Encrypt SSL certificate—commonly abused by threat actors to lend false legitimacy to malicious sites. The infrastructure is designed to evade initial detection, as evidenced by zero detections across 95 VirusTotal engines, indicating that traditional antivirus solutions have not yet flagged its malicious content. The use of Cloudflare’s Pages service further complicates takedown efforts due to the platform’s legitimate reputation and rapid domain deployment capabilities.

Technical analysis of gadyahjd.pages.dev reveals a high-risk phishing campaign targeting credential theft, likely via spoofed login portals mimicking trusted services. The domain’s age and lack of historical blocklist entries suggest it may have been registered recently, further reducing its exposure to reputation-based defenses. Although the registrar is Cloudflare, Inc., the domain itself is hosted on Cloudflare Pages, a serverless platform often exploited for short-lived malicious campaigns due to its ease of deployment and global CDN support. The associated IP address, 188.114.96.3, is part of Cloudflare’s infrastructure, which obfuscates the true origin of the threat and allows for rapid infrastructure changes to bypass blocking mechanisms.

Users who have encountered or interacted with gadyahjd.pages.dev should take immediate precautions to mitigate potential risks. Do not enter any credentials, personal information, or financial details on this domain, as it may be siphoned by the threat actor. If you visited the site, clear your browser cache and cookies, especially if autofill or saved passwords were enabled. Consider running a full antivirus scan using updated detection engines to identify any potential malware artifacts. Report the domain to your security team or trusted threat intelligence platforms to aid in broader detection and takedown efforts. Monitor accounts associated with any credentials entered, and enable multi-factor authentication (MFA) where possible to reduce the impact of stolen credentials. Avoid re-accessing the domain, as it remains active and unflagged by current detection mechanisms.