land-heron[.]pages[.]dev

PhishDestroy identifies land-heron.pages.dev as an active Stripe brand-themed credential theft site. This domain is configured to impersonate the Stripe payment platform’s login interface, aiming to harvest user credentials and payment session tokens. The page is hosted on Cloudflare Pages and leverages a generic heron-themed subdomain to appear legitimate while masking its malicious intent behind a spoofed payment processor interface. No custom drainer kit signatures were detected during initial triage, suggesting the use of a generic credential harvesting template or off-the-shelf stealer code.

Exact technical indicators indicate this domain was registered via Cloudflare, Inc., resolving to IP 188.114.97.3. VirusTotal currently shows 0 detections out of 95 engines, indicating it remains undetected by most antivirus vendors. The domain is secured with a Google Trust Services SSL certificate, increasing its perceived legitimacy. Creation date and Google Safe Browsing (GSB) status are pending full OSINT confirmation, though initial scans show no inclusion in major blocklists to date. The absence of detections suggests a low-profile campaign still in early deployment, likely targeting users expecting Stripe-related communications.

This domain is flagged as active and under investigation with high-risk potential due to its brand impersonation and credential theft objective. Immediate response actions include domain takedown requests to Cloudflare abuse channels and notification to Stripe’s threat response team via their phishing reporting portal. Users should avoid accessing the domain entirely and report any accidental access or credential entry via official Stripe support channels. Remaining risk is assessed as moderate due to low detection coverage and active hosting on a trusted Cloudflare domain, increasing the likelihood of successful compromise for unsuspecting users. Full forensic analysis is ongoing to identify additional infrastructure and campaign scope.