formprism-static[.]pages[.]dev

This domain is flagged as an active credential harvesting phishing site targeting users through fraudulent web forms. The site presents itself as a legitimate form-building service, claiming users can 'Add forms to your site in less than 1 minute.' Such phishing pages are designed to mimic trusted platforms, tricking victims into entering sensitive login credentials, payment details, or personal information, which are then captured by threat actors for malicious use. Analysis indicates the domain was registered on February 03, 2024, through Cloudflare, Inc., and resolves to the IP address 172.66.44.84, hosted on Cloudflare’s infrastructure in the US (AS13335). Despite its recent creation, the domain has already been added to one security blocklist. VirusTotal analysis shows 0 detections out of 95 engines, suggesting it has not yet been widely flagged, though this does not diminish its potential risk. The SSL certificate is issued by Google Trust Services (WE1), a common tactic used to lend false legitimacy to phishing sites. If a user has visited formprism-static.pages.dev or interacted with its content, immediate action is required. First, cease all interaction with the site and avoid entering any personal or sensitive information. If credentials were submitted, reset passwords for all associated accounts, prioritizing email, financial, and work-related services. Enable multi-factor authentication where available. Monitor accounts for unauthorized activity and report any suspicious transactions. Users should also scan their devices for malware, as phishing sites may deploy additional payloads. Finally, report the domain to security teams or threat intelligence platforms to aid in broader mitigation efforts.