event-virl[.]pages[.]dev

This domain, event-virl.pages.dev, is currently hosting an active phishing site impersonating Cisco Virtual Internet Routing Lab (VIRL). Analysis of the page title, which explicitly displays 'virl', confirms the targeted brand. The infrastructure is actively serving malicious content designed to harvest credentials or distribute unauthorized software under the guise of legitimate Cisco network simulation tools. Infrastructure analysis reveals the domain was registered on May 20, 2026, through Cloudflare, Inc., an uncommon creation date suggesting potential domain spoofing or typosquatting. It resolves to the IP address 172.66.47.65, geolocated to Canada and associated with Cloudflare's network. The domain appears on one security blocklist and is flagged by 1 of 95 security vendors on VirusTotal, indicating emerging detection. The SSL certificate is issued by Let's Encrypt (serial number E8), a common choice for both legitimate and malicious sites due to its free and automated issuance process. The domain remains active as of the latest verification, posing an ongoing risk to network engineers and IT professionals. Organizations are advised to block the domain and IP at the perimeter, update endpoint detection rules to include this indicator, and conduct internal awareness training highlighting the specific Cisco VIRL impersonation tactic. Network administrators should verify any recent downloads or logins associated with Cisco VIRL through official channels only.