tta-cms-web[.]pages[.]dev

The domain tta-cms-web.pages.dev has been observed delivering a Microsoft‑brand impersonation campaign. The site presents a login page titled “Aanmelden bij uw account”, which mimics the language of Microsoft account authentication. The campaign is currently listed as active and its risk level is under investigation. The infrastructure is already flagged by the PhishDestroy blocklist and appears on one additional security blocklist. Technical analysis shows the domain resolves to the IP address 40.126.32.74, which belongs to the Cloudflare network (AS13335) and is geolocated in the United States. The domain is hosted behind Cloudflare’s edge service, using the nameservers sreeni.ns.cloudflare.com and yevgen.ns.cloudflare.com. TLS termination is provided by Google Trust Services under the WE1 certificate, and HTTP Strict Transport Security (HSTS) is enforced. The web server returns an HTTP 302 redirect, likely steering victims to a secondary payload host. The page’s visual design aligns with a cryptocurrency‑themed scam, as indicated by the “cryptocurrency” classification in the intelligence feed. The site carries a Gridinsoft trust score of 0 out of 100, reflecting a high confidence of malicious intent. Despite the lack of detections on VirusTotal (0/95), the low trust score and active blocklist entries suggest the domain is being used for credential harvesting. Defenders should add 40.126.32.74 and the full domain to network deny lists, monitor DNS queries for the associated Cloudflare nameservers, and enforce email filtering rules that detect the Dutch‑language login phrase “Aanmelden bij uw account”. Continuous threat‑intelligence feeds should be consulted for any new indicators, and any compromised credentials should be forced to reset. Given the active status, organizations should treat this infrastructure as a high‑priority indicator of compromise.