gradientrisk[.]pages[.]dev

PhishDestroy identifies gradientrisk.pages.dev as an active credential-harvesting phishing site deployed on Cloudflare’s Pages platform. The domain is configured to impersonate a legitimate login portal, tricking victims into submitting usernames, passwords, and multi-factor codes. Traffic is routed through Cloudflare’s IP 172.66.44.201, which is currently resolving gradientrisk.pages.dev. At the time of writing, VirusTotal reports zero security vendors detecting the page, indicating no blocklist coverage. This domain was flagged with threat type generic_phishing under seed 634f5b. The threat is hosted through Cloudflare, Inc. and resolves to IP 172.66.44.201 using a Google Trust Services SSL certificate. To date, no antivirus engines have flagged the page, and the domain remains unlisted on major threat intelligence blocklists. The lack of detections increases exposure to unsuspecting users, who may fall victim before the page is neutralized. If you visited gradientrisk.pages.dev or entered credentials, assume they are compromised. Change passwords on affected accounts immediately and enable multi-factor authentication. Clear browser cookies and scan local devices for malware, as phishing pages often deliver follow-on payloads. Consider reporting the domain to your browser or security vendor for takedown. Do not reuse passwords across services to prevent credential-stuffing attacks.