begin-doc-live[.]pages[.]dev

PhishDestroy has identified the active phishing domain begin-doc-live.pages.dev leveraging a deceptive Google Docs login page as part of a credential harvesting campaign. The campaign is currently classified under the generic_phishing threat type and remains under investigation, indicating ongoing threat actor activity and adaptation. While no specific brand is mimicked in the reported intelligence, the use of a Google Trust Services SSL certificate suggests an attempt to enhance credibility and bypass email security filters. The phishing page is hosted on Cloudflare Pages, a legitimate service abused for rapid deployment and evasion of takedown efforts. Technical indicators confirm the domain resolves to IP address 172.66.44.253, a Cloudflare-operated endpoint. The domain was registered through Cloudflare, Inc., with VirusTotal currently showing 12 out of 95 security vendors detecting the threat, indicating a zero-day or highly evasive phishing page. The SSL certificate is issued by Google Trust Services, which may be leveraged to falsely signal legitimacy to potential victims. As of current analysis, the domain has not been flagged by Google Safe Browsing, and no blocklist presence has been recorded. These attributes combine to create a deceptive and persistent threat vector. The domain remains active and poses a credible risk to unsuspecting users, particularly those accustomed to legitimate Google Docs workflows. PhishDestroy has flagged this domain as under active investigation and is coordinating with hosting and security partners to expedite takedown. Users are strongly advised to avoid interacting with any unsolicited Google Docs or document-sharing links, especially those hosted on pages.dev domains. Always verify the sender's email address and inspect URLs for discrepancies. Report suspicious activity immediately to your security team or through trusted threat intelligence platforms. The current risk level remains elevated due to low detection coverage and active distribution.