ca-portal-test[.]pages[.]dev

Analysis indicates that the domain ca-portal-test.pages.dev is an active phishing portal targeting Conditional Access authentication workflows. The domain was registered on June 15, 2026, through Cloudflare, Inc., and currently resolves to the IP address 188.114.96.3. The page title, 'Conditional Access Assessment Portal,' suggests an attempt to mimic enterprise identity and access management (IAM) systems, though the exact content and targeted brand remain unconfirmed due to lack of direct inspection. Infrastructure analysis reveals the use of Cloudflare hosting, HTTP/3, and HSTS, which may be employed to lend legitimacy or evade detection. The SSL certificate is issued by Google Trust Services, a common but not inherently malicious provider. As of July 12, 2026, the domain is flagged by 9 of 95 security vendors on VirusTotal and appears on one security blocklist, including PhishDestroy. The Gridinsoft trust score of 0/100 further supports its classification as malicious. Defenders should treat this domain as high-risk. The combination of a recently registered domain, Cloudflare hosting, and a page title indicative of IAM phishing warrants immediate blocking at the DNS or proxy level. Network logs should be reviewed for connections to 188.114.96.3 or the domain name, particularly from endpoints with access to enterprise authentication systems. No evidence of a specific phishing kit or targeted brand has been identified in available intelligence, so additional forensic analysis may be required if compromise is suspected.