business-for-flonveroui[.]pages[.]dev

This domain, business-for-flonveroui.pages.dev, is flagged as an elevated-risk credential harvesting phishing site designed to steal user authentication credentials through fraudulent login interfaces. Analysis indicates the infrastructure was specifically engineered to mimic legitimate business portals, a common tactic in targeted phishing campaigns. The domain exhibits multiple high-confidence indicators of malicious intent, including its recent creation and immediate appearance on security blocklists. Infrastructure analysis reveals the following technical indicators: the domain was registered on October 22, 2025, through Cloudflare, Inc., and resolved to IP address 188.114.97.3 (AS13335, United States). The SSL certificate was issued by Google Trust Services (WE1), a legitimate provider often abused by threat actors to lend credibility. The domain appears on two security blocklists (PhishDestroy and PhishingDB) and is flagged by 18 out of 95 security vendors on VirusTotal. Despite its current offline status, historical records confirm its prior classification as a suspected phishing site by the hosting provider. Mitigation steps for this specific threat type include immediate blocking of the domain and its associated IP address (188.114.97.3) at the network perimeter. Organizations should implement strict filtering rules to prevent access to newly registered domains (NRDs) created within the last 30 days, particularly those hosted on content delivery networks. End-user training should emphasize the risks of credential harvesting through fake login portals, with particular attention to domains mimicking business service names. Security teams are advised to monitor for authentication attempts originating from the identified IP range and review logs for interactions with the domain prior to its takedown.