build-client[.]pages[.]dev

This domain is flagged as a credential harvesting phishing site targeting users through deceptive login interfaces. Analysis indicates it is designed to mimic legitimate authentication portals, tricking visitors into submitting usernames, passwords, and potentially multi-factor authentication codes. The site remains operational and poses a direct risk to individuals and organizations relying on cloud-based or enterprise authentication systems. Infrastructure analysis reveals the domain is registered through Cloudflare, Inc., and currently resolves to the IP address 172.66.44.133. As of the latest scan, VirusTotal reports zero detections across 95 security engines, suggesting the phishing content has not yet been widely identified or classified. The domain remains active, with no observed takedown or mitigation efforts in place. The lack of prior detection increases the likelihood of successful compromise for unsuspecting users. Users who have visited build-client.pages.dev or entered credentials on the site should immediately revoke any submitted passwords and enable multi-factor authentication on associated accounts. Network administrators are advised to block the domain and IP address 172.66.44.133 at the perimeter level. Monitor for unusual authentication attempts or unauthorized access originating from affected accounts. If corporate credentials were exposed, initiate incident response protocols, including forced password resets and log reviews for anomalous activity. Report the domain to relevant abuse channels for further investigation and takedown.