csomagnet[.]pages[.]dev

This domain, csomagnet.pages.dev, is currently active and flagged as a credential theft phishing site. Analysis indicates it is designed to harvest user login credentials through deceptive login portals, likely mimicking legitimate services to exploit unsuspecting victims. No specific brand impersonation has been confirmed, but the infrastructure aligns with credential harvesting campaigns observed in recent months. Infrastructure analysis reveals the domain was registered on May 20, 2026, through Cloudflare, Inc., and resolves to the IP address 172.66.47.169, located in Canada. The SSL certificate is issued by Let's Encrypt (serial number E8), a common choice for both legitimate and malicious sites. Security vendors have flagged this domain, with 1 of 95 VirusTotal engines detecting it as malicious. Additionally, the domain appears on one security blocklist, and its hosting provider, Cloudflare, Inc., is frequently used to obfuscate the true origin of phishing infrastructure. As of the latest verification, csomagnet.pages.dev remains active and operational. Organizations are advised to block the domain and its associated IP address (172.66.47.169) at the network perimeter. Endpoint protection solutions should be updated to include this domain in their threat intelligence feeds. Users who may have interacted with the site should be instructed to reset credentials for any accounts accessed during the exposure window, particularly if multi-factor authentication was not enabled. Continuous monitoring for related domains or IPs registered under the same infrastructure is recommended.