shporingtfilesasnxmdocsxexaelamdhx[.]pages[.]dev

This domain, shporingtfilesasnxmdocsxexaelamdhx.pages.dev, is actively engaged in credential theft operations. Analysis indicates the site mimics legitimate document or file-sharing portals to harvest user credentials, including corporate login details, personal email accounts, or cloud storage access. The obfuscated naming convention (e.g., 'shporingtfilesasnxmdocsx') suggests an attempt to evade detection while impersonating trusted platforms, a common tactic in targeted phishing campaigns. Users are likely lured via email or messaging platforms with urgent requests to access or verify documents, redirecting them to fraudulent login pages designed to capture entered credentials in real time. Evidence supporting this assessment includes detection by 7 out of 95 security vendors on VirusTotal, indicating a high-confidence malicious classification. The domain was registered on May 21, 2026, through Cloudflare, Inc., and currently resolves to the IP address 172.66.44.150, hosted in a Cloudflare data center in California. It appears on one security blocklist, further corroborating its malicious intent. The SSL certificate, issued by Let's Encrypt (serial number E7), provides a false sense of security while encrypting traffic between the victim and the attacker-controlled server. Infrastructure analysis reveals the use of Cloudflare Pages, a legitimate service often abused for phishing due to its free hosting and built-in SSL capabilities. Users who have visited this domain or entered credentials on its pages should immediately take remedial action. First, revoke any entered credentials, particularly for corporate accounts, email services, or cloud storage platforms. Enable multi-factor authentication (MFA) on all critical accounts to mitigate unauthorized access. Scan local devices for malware, as credential theft sites may deploy additional payloads. Report the incident to internal security teams or relevant authorities to assist in tracking the campaign. Monitor financial and communication accounts for signs of compromise, such as unauthorized logins or transactions. If the domain was accessed via a corporate device, follow organizational incident response protocols to contain potential exposure.