valvfauth[.]pages[.]dev

This domain is flagged as a high-risk credential phishing endpoint targeting users through deceptive authentication prompts. Analysis indicates the site mimics legitimate login portals, specifically impersonating Guildhall-related services, to harvest credentials or sensitive information. The threat type is classified as generic_phishing with a focus on credential theft, a common tactic for account takeovers and subsequent fraudulent activity. Infrastructure analysis reveals the domain was registered on April 23, 2025, through Cloudflare, Inc., and remains active. It resolves to the IP address 188.114.96.3, associated with AS13335 (Cloudflare, Inc.) and geolocated in the US. The domain appears on four security blocklists and is flagged by 6 out of 95 security vendors on VirusTotal. SSL certification is provided by Google Trust Services (WE1), a legitimate but frequently abused certificate authority in phishing campaigns. The page title, Guildhall, suggests an attempt to impersonate a trusted platform or service. Mitigation requires immediate blocking of the domain and its resolving IP (188.114.96.3) at the network perimeter. Security teams should prioritize endpoint detection rules to identify and quarantine any attempts to access valvfauth.pages.dev. Users who may have interacted with the domain should be instructed to reset credentials for any accounts accessed during the exposure window, particularly if multi-factor authentication was not enabled. Monitoring for anomalous authentication attempts or session hijacking linked to this domain is recommended for the next 30 days.