authd-pro-app[.]pages[.]dev

This domain, authd-pro-app.pages.dev, is identified as a credential theft phishing site designed to harvest user login credentials through fraudulent login portals. Analysis indicates no direct association with a specific brand or cryptocurrency drainer kit, though the infrastructure mimics legitimate authentication flows to deceive targets. The campaign appears to target general user credentials rather than financial or cryptocurrency-specific data. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on October 07, 2025, and resolves to the IP address 188.114.97.3, hosted under AS13335 (Cloudflare, Inc.) in the United States. The domain is flagged by Google Safe Browsing as phishing and appears on one security blocklist. Detection engines report a VirusTotal score of 13/95, with security vendors confirming malicious intent. The SSL certificate is issued by Google Trust Services (WE1), a common attribute in both legitimate and malicious Cloudflare-hosted pages. As of the latest assessment, authd-pro-app.pages.dev has been taken offline, likely in response to detection and reporting. However, residual risk remains due to the potential for infrastructure reuse or domain reactivation. Users who interacted with the site prior to takedown may still be at risk of credential exposure. Recommendations include monitoring for unauthorized account access, resetting passwords for any accounts entered on the site, and deploying endpoint protection to detect similar phishing attempts. Network-level blocking of the IP 188.114.97.3 is advised for organizations to prevent future exposure.