caldera-cmz[.]pages[.]dev

PhishDestroy identifies caldera-cmz.pages.dev as an active credential harvesting domain impersonating Caldera, a leading incident response automation platform. The domain remains under investigation following its recent flagging by security researchers and is currently classified as a high-risk threat vector due to its live status and deceptive infrastructure.

This domain was flagged by 0 of 95 VirusTotal vendors as of the latest scan, indicating an extremely low detection rate despite its active phishing operations. Registered through Cloudflare, Inc., the domain resolves to IP address 172.66.47.172 and operates under a Google Trust Services SSL certificate, which may contribute to its legitimacy in the eyes of potential victims. The absence of blocklist entries suggests this threat is either newly emergent or deliberately avoiding detection through the use of evasive hosting infrastructure.

The current status of caldera-cmz.pages.dev remains active, with no detections recorded by VirusTotal. Users are strongly advised to avoid interacting with this domain and report any suspicious activity involving Caldera credentials to their security teams. Security researchers should monitor this domain for updates and contribute intelligence to threat-sharing platforms to enhance collective defense against this credential harvesting campaign.