open-ecosystem[.]pages[.]dev

PhishDestroy has flagged open-ecosystem.pages.dev for hosting a credential-harvesting page designed to trick visitors into surrendering usernames and passwords. This site mimics legitimate login interfaces to lure users into entering sensitive information, which is then exfiltrated to attacker-controlled servers. The page purports to offer access to a so-called open ecosystem, but the only thing being harvested is unwary victims’ credentials. Treat any unsolicited link to this domain as a red flag and do not interact with its login prompts. This domain was flagged during a routine sweep of recently registered Cloudflare pages. It currently resolves to 172.66.47.67 and is served over HTTPS with a Google Trust Services certificate—both of which can give a false sense of legitimacy. VirusTotal analysis at the time of discovery returned 0 detections out of 95 engines, indicating the page has evaded detection so far. The domain itself was created within the last 30 days and is registered through Cloudflare, Inc., which explains its rapid propagation and the absence of reputation-based blocks. If you or anyone in your organization has visited open-ecosystem.pages.dev, assume credentials entered on the site have been compromised. Immediately rotate passwords used on that site and enable multi-factor authentication wherever possible. Report the incident to your security team, run a full endpoint scan, and consider revoking any session tokens that may have been exposed. Use this incident to reinforce phishing awareness and remind staff to verify unexpected URLs before entering credentials.