echo-app-a2j[.]pages[.]dev

PhishDestroy identifies echo-app-a2j.pages.dev as an active credential-harvesting probe under investigation at risk level under_investigation. The site presents itself as a legitimate login interface while exfiltrating entered credentials to unauthorized third parties. The domain points to IP 188.114.97.3, is registered through Cloudflare, Inc., and secured with a Let’s Encrypt SSL certificate. VirusTotal currently records 1/95 antivirus engines detecting malicious content; no public blocklist entries or trust-score penalties have yet been logged. The site leverages Cloudflare Pages to blend with benign hosting infrastructure, complicating early detection. Users who encounter echo-app-a2j.pages.dev should immediately refrain from entering any credentials, close the tab, clear cached credentials for the targeted service, and update passwords using a different device or network. If credentials were already entered, revoke access in the legitimate service account settings, enable two-factor authentication, and scan local devices for malware. Administrators should block 188.114.97.3 at the firewall and report the domain to Cloudflare’s abuse portal to accelerate takedown.