blackpan[.]pages[.]dev

PhishDestroy identifies blackpan.pages.dev as a live credential-phishing site impersonating the Black Panther Hub platform. Intelligence confirms the campaign remains active as of today, with the domain serving a deceptive login interface designed to harvest user credentials and session tokens.

This domain resolves to IP 172.66.45.29 via Cloudflare, Inc. and currently carries an SSL certificate issued by Google Trust Services. As of the latest scan, the page remained undetected by all 95 VirusTotal vendors, indicating a low detection signature that enables ongoing campaigns. Cloudflare’s infrastructure obscures origin details, complicating takedown while the Google-trusted certificate lends false legitimacy to the fraudulent login page.

PhishDestroy assesses the risk as active and escalating due to the absence of vendor detection and the use of reputable infrastructure services. Users are advised to avoid accessing blackpan.pages.dev and to report the domain through their email provider’s abuse channels and to local CERT teams. Organizations are urged to update browser blocklists with IP 172.66.45.29 and domain blackpan.pages.dev immediately. Credential reuse across services should be halted, and multi-factor authentication enforced where possible to mitigate potential account compromise.