normilio[.]pages[.]dev

This domain, normilio.pages.dev, is identified as an active credential harvesting phishing site targeting users through deceptive login interfaces. The page title, NORMILIO, suggests an attempt to impersonate a legitimate service or brand, though no direct affiliation with known corporate entities has been confirmed. The infrastructure lacks overt ties to known phishing kits, but the domain’s recent creation and Cloudflare-hosted frontend align with common evasion tactics used in credential theft campaigns. Analysis indicates the domain was registered on June 08, 2024, through Cloudflare, Inc., and resolves to the IP address 172.66.47.31, part of AS13335 (Cloudflare, Inc.) located in the United States. Detection metrics reveal the domain is flagged by 2 out of 95 security vendors on VirusTotal, while two independent security blocklists—PhishDestroy and Enkrypt—have classified it as malicious. The SSL certificate, issued by Google Trust Services (WE1), provides encrypted connections, a tactic frequently exploited to lend false legitimacy to phishing pages. No entries were found in Google Safe Browsing at the time of analysis, indicating either recent deployment or successful evasion of automated crawlers. The domain remains active as of the latest verification, posing a continued risk to users encountering it through phishing links distributed via email, social engineering, or malvertising. No takedown requests or registrar enforcement actions have been observed, and the Cloudflare-hosted infrastructure complicates mitigation efforts. Organizations are advised to block the domain and associated IP at the network perimeter, while end users should treat unsolicited login prompts from this domain as fraudulent. Continuous monitoring of related infrastructure is recommended, as threat actors frequently rotate domains to sustain campaigns.