vpcardex[.]pages[.]dev

PhishDestroy identifies the recently activated domain vpcardex.pages.dev as an active phishing page posing as a credit-card checkout portal designed to harvest stolen payment data. The page title is exactly vpcardex, strongly suggesting a spoof of a legitimate credit-card service brand or scheme. No drainer kit fingerprint is available yet, so attribution to a known crime group remains under investigation. The domain was registered through Cloudflare, Inc. under a Cloudflare Pages subdomain and is protected by a Let’s Encrypt SSL certificate issued 2024-05-23. It resolves to ASN 13335 operated by Cloudflare on 188.114.97.3. VirusTotal currently returns 0/95 detections, has not yet been listed in Google Safe Browsing, and remains absent from all major public blocklists. Creation date and earlier passive DNS records are masked by Cloudflare’s proxy service, limiting historical context. The page is still live and actively serving phishing content. Users who encounter the domain should immediately stop any data entry, close the browser tab, and avoid revisiting the URL. Blocking 188.114.97.3 at the network perimeter and flagging the domain in corporate DNS/URL filters is advised. The remaining risk is medium-high because the domain has zero vendor detections yet and remains capable of collecting live payment card data from unsuspecting victims.