webed-cloud-upxold-loxic[.]pages[.]dev

This domain, webed-cloud-upxold-loxic.pages.dev, is identified as a high-risk generic phishing site designed to harvest user credentials through fraudulent authentication portals. Analysis indicates the infrastructure mimics legitimate Cloudflare login pages, likely leveraging a pre-built phishing kit to automate credential theft. While no specific drainer kit is confirmed, the domain's design and structure align with common phishing toolkits used to target enterprise and individual users under the guise of cloud service authentication. Infrastructure analysis reveals the following technical indicators: the domain is flagged by 12 out of 95 security vendors on VirusTotal, registered through Cloudflare, Inc., and resolves to the IP address 172.66.44.108, hosted on AS13335 (Cloudflare, Inc.) in the United States. The domain was created on November 05, 2025, and is currently blocked by Google Safe Browsing for phishing activity. Additionally, it appears on one security blocklist, and its SSL certificate is issued by Google Trust Services (WE1), a common certificate authority for both legitimate and malicious domains. The domain is currently offline, likely due to takedown actions by the hosting provider or security teams. However, residual risk persists as threat actors may re-deploy the phishing kit under a new domain or subdomain. Users who interacted with this site should immediately reset credentials for any accounts accessed during the exposure window, particularly those tied to cloud services or enterprise authentication portals. Organizations are advised to monitor for unauthorized access attempts and implement multi-factor authentication to mitigate credential-based attacks. Continuous vigilance is recommended, as phishing campaigns often recycle infrastructure or tactics.