dark-forest[.]pages[.]dev

This domain, dark-forest.pages.dev, operates as a credential theft portal designed to harvest user login credentials through deceptive login interfaces. Analysis indicates the site impersonates legitimate authentication pages, likely targeting users of cloud services or enterprise platforms to capture usernames, passwords, and session tokens. The infrastructure mimics trusted services, increasing the likelihood of successful deception for unsuspecting visitors. Evidence confirms the domain's malicious nature through multiple technical indicators. VirusTotal reports 17 out of 95 security vendors flagging the domain as malicious, while it appears on two distinct security blocklists: PhishDestroy and PhishingDB. The domain was registered on October 02, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.47.4, hosted on AS13335. The SSL certificate, issued by Google Trust Services (WE1), further aligns with known phishing infrastructure patterns. Users who visited dark-forest.pages.dev should immediately revoke any entered credentials, particularly for cloud services or enterprise accounts. Reset passwords using a separate, secure device and enable multi-factor authentication where available. Monitor accounts for unauthorized access or suspicious activity, and report the incident to relevant security teams for further investigation. The domain is currently offline, but similar threats may persist under different addresses.