one-line-ph-prod[.]pages[.]dev

PhishDestroy identifies one-line-ph-prod.pages.dev as an active credential-theft endpoint masquerading as a legitimate service. The page is engineered to harvest login credentials under the guise of a single-line input utility, leveraging Cloudflare Workers to evade traditional hosting-based detection. Security teams should treat this as a live data-exfiltration threat targeting unsuspecting users.

The domain’s infrastructure and operational indicators reinforce the risk profile. VirusTotal currently shows 0 detections out of 95 engines, underscoring the evasive nature of the payload hosted on 188.114.96.3. The domain is registered via Cloudflare, Inc., utilizing a Google Trust Services SSL certificate to further mimic legitimacy. While the exact creation date is obscured by Cloudflare’s proxy, the domain’s status as ‘under_investigation’ and active ‘generic_phishing’ tag indicate recent deployment aimed at low-friction credential capture.

Users who visited one-line-ph-prod.pages.dev should immediately revoke any entered credentials, enable multi-factor authentication on related accounts, and scan local devices for malware or keyloggers. Avoid interacting with the domain and update network blocklists to include 188.114.96.3. Report indicators to your security team and consider deploying Cloudflare’s Known Abusive IP list to prevent recurrence.