grow3[.]pages[.]dev

This domain is flagged as a high-risk credential harvesting phishing site targeting enterprise users. Analysis indicates the infrastructure is designed to deceive victims into submitting login credentials under the guise of accessing a 'Project Database Server', a common tactic for corporate espionage or unauthorized data access. The threat type is classified as generic_phishing with a focus on credential theft, as evidenced by the page title and detected technologies. Infrastructure analysis reveals the domain grow3.pages.dev resolves to IP address 172.66.47.112, hosted on Cloudflare’s network. The SSL certificate is issued by Google Trust Services, and the domain is registered through Cloudflare, Inc. Technologies detected include jsDelivr, jQuery, HSTS, Google Hosted Libraries, EmailJS, and HTTP/3, suggesting a modern, obfuscated phishing framework. VirusTotal reports only 1 out of 95 security vendors currently flag this domain, indicating low detection rates and potential evasion of automated defenses. No historical blocklist entries or trust score data were found, further complicating early identification. Mitigation steps for this threat include immediate blocking of the domain grow3.pages.dev and its resolving IP 172.66.47.112 at the network perimeter. Security teams should deploy endpoint detection rules to flag any attempts to access this domain, particularly in environments where 'Project Database Server' or similar internal resources are referenced. User awareness training should emphasize the risks of credential submission on untrusted pages, even those hosted on seemingly legitimate CDN infrastructure. Monitoring for outbound connections to EmailJS or jsDelivr endpoints may also help identify compromised hosts or ongoing phishing attempts. Given the low detection rate, manual verification of any alerts tied to this domain is recommended.