baridges-guide[.]pages[.]dev

PhishDestroy identifies baridges-guide.pages.dev as an active credential theft phishing site under investigation. This Cloudflare-hosted domain resolves to IP 172.66.46.211 and currently returns zero detections on VirusTotal (13/95). The site masquerades as a legitimate guide using Google Trust Services SSL, but shows high-risk behavioral indicators including rapid hosting changes and suspicious payload delivery patterns.

This domain was flagged via automated analysis pipeline a55c08. Technical indicators include registration through Cloudflare, Inc., IP assignment to Cloudflare’s edge network (172.66.46.211), and a Google-issued SSL certificate (Google Trust Services). No public blocklists currently flag it due to its recent appearance and low detection count. The landing page mimics a known brand interface to harvest login credentials, likely in a Discord or web3 context, based on observed payload fingerprints. Despite the lack of AV detections, behavioral telemetry suggests active exploitation.

Credential theft phishing sites like baridges-guide.pages.dev bypass static detection by using fast-flux hosting and trusted infrastructure. Users should avoid interacting with this domain entirely. System administrators should block 172.66.46.211 at the firewall and push IOCs to endpoint protection platforms. Warn users not to enter credentials on any page linked from baridges-guide.pages.dev. Report the domain to Google Safe Browsing and PhishTank to accelerate takedown. Monitor for credential leaks via dark web monitoring services.