cookie-dpl[.]pages[.]dev

PhishDestroy identifies an active credential theft campaign hosted at cookie-dpl.pages.dev that mimics legitimate login portals to harvest user credentials. This Cloudflare Pages domain (registered through Cloudflare, Inc.) resolves to IP 188.114.97.3 and leverages a Google Trust Services SSL certificate to appear legitimate. The infrastructure is clean on VirusTotal with 0 detections out of 95 engines as of the latest scan, indicating a low detection rate despite active abuse, which raises concerns about its ability to evade traditional security measures.

Technical indicators corroborate the threat assessment: the domain was registered through Cloudflare, Inc., a common choice among threat actors seeking anonymity and rapid deployment capabilities. The IP address 188.114.97.3 is associated with multiple low-reputation activities, further suggesting malicious intent. The domain currently shows no presence on major blocklists, exacerbating the risk as users and automated systems lack preemptive protections. The combination of a trusted SSL certificate and low detection rate makes this domain particularly dangerous for end-users who may unknowingly disclose sensitive credentials.

Users who visited cookie-dpl.pages.dev should immediately assess whether any credentials were entered and change passwords for affected accounts. Enable multi-factor authentication wherever possible and scan devices for malware using reputable security software. Organizations are advised to block the domain at the network level and monitor for anomalous login attempts. Report the domain to threat intelligence platforms and security vendors to improve detection and disrupt the campaign. Proactive measures, including user awareness training, are critical to mitigating further exploitation.