sfffuff[.]pages[.]dev

PhishDestroy identifies sfffuff.pages.dev as a live phishing domain masquerading as the Brawl Stars Mechmas Event, luring users into credential theft under Cloudflare Pages hosting. This domain was flagged with a generic phishing threat vector, leveraging a spoofed gaming event to harvest login details in what appears to be a draener-style campaign targeting mobile gamers. The lure closely mimics Supercell’s event branding to maximize click-through rates while remaining undetected by security engines.

Technical indicators confirm this domain resolves to IP 188.114.96.3 and is registered via Cloudflare, Inc., with a Google Trust Services SSL certificate. VirusTotal currently shows 0/95 detections, indicating zero detection coverage as of this advisory. While the exact registration date remains unverified, the domain remains active and unlisted by Google Safe Browsing. A scan across open threat intelligence feeds reveals no prior blocklist entries, suggesting a newly deployed campaign with minimal historical footprint.

This domain is currently active and under active monitoring by PhishDestroy. Users are strongly advised to block sfffuff.pages.dev at the network perimeter and avoid accessing the link entirely. The lack of VirusTotal detections and absence from blocklists elevate the risk of successful user compromise. Security teams should implement DNS sinkholing for this domain and monitor for associated credential dumps on dark web channels. Remaining risk is classified as elevated due to undetected status and active lure.