cookie-ccw[.]pages[.]dev

Analysis as of August 03, 2026 indicates that the domain cookie-ccw.pages.dev is actively leveraged for credential harvesting campaigns. The domain is hosted on Cloudflare Pages, a static‑site service that masks the underlying infrastructure and provides automatic TLS termination, making attribution to a concrete IP address or autonomous system difficult without deeper network probing. The domain has been added to two public security blocklists and is currently listed by the PhishDestroy and ScamSniffer filtering services, confirming that at least two independent anti‑phishing feeds have observed malicious use.

VirusTotal records show that the site was scanned by 91 commercial and open‑source engines; none of the scanners raised a detection, which reflects the common practice of employing minimalist HTML and avoiding known malicious payloads rather than an indication of benign intent. No public Safe Browsing, OTX, or similar reputation feeds have indexed the domain, and no page title or brand targeting information is publicly disclosed, leaving the exact lure and victim profile uncertain.

Defenders should block the hostname at DNS or proxy level, monitor for outbound connections to the Cloudflare edge network that resolve to this name, and consider adding the domain to internal blocklists. Because the hosting provider can serve many unrelated sites, further investigation—such as retrieving the live page, examining TLS certificate details, and correlating request patterns with known credential‑stealing campaigns—will be required to fully characterize the threat vector and to attribute the operators.