qrismedicvd[.]pages[.]dev

This domain is flagged as a fake medical login portal designed to harvest credentials from healthcare professionals or patients. Analysis indicates the site mimics legitimate telemedicine platforms, prompting users to enter sensitive login details, which are then captured by threat actors. The attack may also distribute malware under the guise of medical software updates or patient forms, increasing the risk of data theft or system compromise. Infrastructure analysis reveals the domain was registered through Cloudflare Pages on May 25, 2026, a service often exploited for rapid deployment of phishing sites due to its free hosting and SSL certificates. As of the latest scan, 3 out of 95 security vendors on VirusTotal detect this domain as malicious, with one confirmed blocklist entry. The creation date suggests the site was set up specifically for short-term fraud campaigns, a common tactic in credential theft operations. If you visited qrismedicvd.pages.dev, immediately disconnect the device from the network to prevent further data transmission. Run a full system scan using updated security tools to detect any installed malware. Change passwords for any accounts accessed on the device, especially those related to healthcare or financial services, using a separate, secure device. Monitor accounts for unauthorized activity and enable multi-factor authentication where possible. Report the incident to your organization’s security team or a trusted cybersecurity professional for further analysis.