grasslink[.]pages[.]dev

PhishDestroy identifies grasslink.pages.dev as an active credential harvesting phishing domain designed to trick users into submitting sensitive login credentials. This domain leverages Cloudflare Pages to host a deceptive landing page mimicking legitimate login portals, often distributed via phishing campaigns or malvertising. The infrastructure, resolving to 188.114.97.3 with a Let’s Encrypt SSL certificate, adds a veneer of legitimacy, increasing the likelihood of successful deception. Users encountering this domain should treat it as a high-risk threat until further analysis confirms otherwise, as the absence of detections does not equate to safety.

Technical indicators and observed behavior reinforce the need for caution. VirusTotal currently flags 0 out of 95 security engines, indicating a low initial detection rate despite the domain’s malicious intent. Registered through Cloudflare, Inc., this domain operates under Cloudflare Pages, a service frequently abused for phishing due to its free tier and rapid deployment capabilities. While the exact registration date remains unverified, the domain’s active status and low detection rate suggest it is either newly deployed or actively evading detection mechanisms. The combination of a trusted hosting provider, valid SSL certificate, and absence of blocklist entries creates a dangerous profile that necessitates immediate scrutiny.

If you or your organization have interacted with grasslink.pages.dev—whether by visiting the site, entering credentials, or downloading files—take immediate action to mitigate potential risks. First, disconnect any systems that may have been exposed to the domain to prevent lateral movement or further compromise. Next, reset passwords for accounts that share credentials with those potentially entered on the site, prioritizing email, financial, and corporate login credentials. Finally, scan affected devices for malware or unauthorized access using updated endpoint protection tools. Organizations should also consider blocking the domain at the network perimeter and reviewing logs for any signs of associated malicious activity. Proactive monitoring and user awareness training are critical to preventing further exploitation of this and similar threats.