bribges-guide[.]pages[.]dev

PhishDestroy identifies active phishing domain bribges-guide.pages.dev impersonating a travel guide service to harvest credentials and payment details. This fraudulent Pages.dev subdomain employs social engineering tactics to deceive users into submitting sensitive information under the guise of accessing exclusive travel content. No advanced drainer kit or JavaScript obfuscation was detected during initial analysis, suggesting an opportunistic campaign leveraging Cloudflare Workers for rapid deployment.

This domain resolves to IP 172.66.44.52 and is registered through Cloudflare, Inc. VirusTotal analysis shows 3/95 detection engines flagged the domain as malicious at the time of assessment. The SSL certificate is issued by Google Trust Services, which may contribute to user trust while obscuring malicious infrastructure. Exact creation date remains unverified due to Cloudflare’s privacy protections, but the domain’s active status indicates recent deployment. Google Safe Browsing (GSB) has not yet blacklisted this domain, and the current blocklist count is zero. These technical indicators suggest a newly emerged threat with minimal historical detection.

The domain remains active as of the latest assessment, with PhishDestroy’s investigation ongoing. Users are advised to avoid interacting with bribges-guide.pages.dev and report any suspicious activity immediately. Remaining risk is classified as under investigation due to the absence of historical detections, but the lack of safeguards (e.g., domain age, GSB blacklisting) increases the likelihood of successful exploitation. Security teams should monitor for associated IP ranges and certificate fingerprints while implementing network-level blocking to mitigate exposure. Immediate user education on recognizing fake travel guide scams is strongly recommended.