run-service[.]pages[.]dev

This domain, run-service.pages.dev, is flagged as a generic phishing resource designed to harvest user credentials through deceptive login interfaces. Analysis indicates no direct association with a specific brand or drainer kit, though the infrastructure aligns with common phishing campaigns leveraging cloud-based hosting for rapid deployment. The absence of a targeted brand impersonation suggests a broader, opportunistic approach to credential theft, likely distributed via malicious links in emails or social engineering vectors. Technical indicators reveal the domain is registered through Cloudflare, Inc., and resolves to the IP address 188.114.96.3. As of the latest scan, VirusTotal reports 0 detections out of 95 engines, indicating the domain has not yet been widely flagged by security vendors. No creation date is publicly available, and Google Safe Browsing (GSB) status remains unconfirmed. Blocklist monitoring services report zero listings, further reducing visibility into its malicious activity. The use of Cloudflare’s registrar and hosting infrastructure complicates attribution and takedown efforts, as the provider’s privacy features obscure ownership details. The domain remains active and under investigation, with no confirmed remediation actions taken at this time. Users are advised to treat any interaction with run-service.pages.dev as high-risk, particularly if prompted for login credentials or personal information. Organizations should monitor network traffic for connections to the domain or its resolving IP (188.114.96.3) and implement blocklist updates as additional intelligence emerges. Given the lack of detections, proactive detection rules—such as monitoring for unexpected redirects or form submissions to the domain—are recommended to mitigate potential exposure.