rodin[.]pages[.]dev

PhishDestroy identifies rodin.pages.dev as a credential theft domain under active exploitation. This Cloudflare Pages-hosted site mimics legitimate login portals to harvest user credentials, posing a severe risk to victims. The infrastructure leverages Google Trust Services for SSL certificates and resolves to 172.66.45.24, a Cloudflare IP range often abused for obfuscation. Current detections remain critically low at 2/95 on VirusTotal, highlighting the need for proactive blocking. rodin.pages.dev exhibits multiple red flags consistent with credential harvesting campaigns. VirusTotal shows 2/95 detections as of the latest scan, while the domain is registered through Cloudflare, Inc. (via Cloudflare Pages) and resolves to IP 172.66.45.24. The SSL certificate is issued by Google Trust Services, which, while legitimate, does not validate the domain's intent. Such low detection rates combined with Cloudflare's abuse-resistant infrastructure create a deceptive appearance of legitimacy, making manual verification essential. To mitigate credential theft risks from rodin.pages.dev, users should avoid interacting with the domain entirely. Enterprises should configure network blocks for the IP 172.66.45.24 and domain rodin.pages.dev at the firewall or DNS level. Employees must verify URLs via official channels before entering credentials, as this domain’s low VirusTotal score indicates it remains under the radar of automated detection systems. Report any accidental interactions to security teams immediately for incident response.