near-cache[.]pages[.]dev

PhishDestroy’s domain safety assessment identifies near-cache.pages.dev as an active credential theft site under investigation for fraudulent activity targeting unsuspecting users. The domain employs a deceptive naming convention to impersonate legitimate caching services, potentially luring victims into entering sensitive login credentials under false pretenses. The threat aligns with known credential theft campaigns that harvest user data for subsequent account takeovers or resale on dark web marketplaces. No specific drainer kit signatures have been publicly documented for this domain as of the latest analysis, but behavioral patterns suggest a focus on mimicking authentic web infrastructure to bypass user suspicion.

Technical indicators for near-cache.pages.dev reveal a concerning lack of detection despite clear malicious intent. VirusTotal currently shows 3/95 detections, indicating the domain remains undetected by major antivirus engines. The domain was registered through Cloudflare, Inc., resolving to IP address 188.114.96.3, which is associated with a broader block of suspicious hosting infrastructure. The SSL certificate is issued by Let’s Encrypt, a common tactic among threat actors to establish false trust. The domain’s creation date and additional metadata remain under review, but its association with the pages.dev subdomain of Cloudflare Pages raises red flags, as legitimate services typically use custom domains rather than subdomains tied to free hosting platforms. The domain has not been flagged by Google Safe Browsing (GSB) as of this assessment, and blocklist counts remain unverified due to its recent emergence.

The current status of near-cache.pages.dev is classified as active with an under-investigation risk level, meaning immediate user exposure is likely but full threat characterization is pending. PhishDestroy recommends immediate avoidance of this domain, including refraining from entering any credentials or sensitive data. Users who may have already interacted with the site are advised to monitor accounts for unauthorized access and enable multi-factor authentication where possible. Organizations should consider blocking the domain at the network level and updating firewall rules to prevent outbound connections. Remaining risk is assessed as moderate due to undetected status and potential for further campaign expansion, necessitating heightened vigilance and proactive threat intelligence updates.