halbornsecurities[.]pages[.]dev

PhishDestroy identifies halbornsecurities.pages.dev as an active fake security-portal phishing site misusing Cloudflare Pages to harvest corporate credentials. This domain poses a targeted risk by mimicking Halborn Security branding to trick employees into surrendering corporate login tokens. The campaign remains under investigation but is already in active distribution, as shown by its live status and seed 24e44a. This domain resolves to Cloudflare IP 172.66.47.42 and is registered via Cloudflare, Inc.; VirusTotal shows zero detections out of 95 engines, no inclusion on public blocklists, and no historical trust score improvements. No creation date is publicly available at this time, indicating recent or stealthy registration to avoid early detection. Without prior reputation or detections, the infrastructure provides threat actors immediate anonymity and short-lived campaign windows before takedowns can occur. To mitigate, users must immediately report any received links or emails referencing halbornsecurities.pages.dev and block the domain at firewall, proxy, and email-gateway levels. Enterprises should verify any security-portal communications through official Halborn Security channels and enable multi-factor authentication on all corporate accounts to reduce credential theft impact. If credentials were entered, force password resets and revoke active sessions immediately; monitor for follow-on social-engineering attempts leveraging the stolen data.