internal-rdpfix[.]pages[.]dev

This domain, internal-rdpfix.pages.dev, is flagged as a high-risk phishing resource targeting remote access credentials. Analysis indicates the site likely impersonated corporate remote desktop protocols (RDP) or IT support portals to trick users into submitting login credentials, session tokens, or multi-factor authentication codes. No specific brand spoofing or drainer kit signatures were identified, though the naming convention suggests a focus on enterprise IT infrastructure deception. The domain exhibits no direct ties to known phishing frameworks but aligns with opportunistic credential harvesting tactics. Infrastructure analysis reveals the domain was registered on August 10, 2025, through Cloudflare, Inc., and resolves to IP address 172.66.47.149 (AS13335, United States). The SSL certificate is issued by Google Trust Services (WE1), a common configuration for Cloudflare-hosted properties. Detection metrics show 15 of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on three independent blocklists, including PhishDestroy, ScamSniffer, and PhishingDB. No Google Safe Browsing (GSB) entries were confirmed at the time of analysis, though this may reflect detection latency rather than benign status. The domain is currently offline, returning a Cloudflare-generated interstitial page titled 'Suspected phishing site.' This suggests takedown action by the hosting provider or domain registrar, though residual risk persists due to potential DNS cache persistence or re-registration under altered infrastructure. Organizations should add the domain and associated IP to internal blocklists, monitor for credential reuse attempts, and verify no internal systems communicated with the endpoint prior to takedown. Network defenders are advised to review logs for connections to 172.66.47.149 and correlate with authentication anomalies from August 10 onward.