garden-kiosk-staging-test[.]pages[.]dev

This domain is flagged as a credential harvesting phishing site, currently under investigation for fraudulent activity targeting user authentication data. Analysis indicates the infrastructure is designed to mimic legitimate login portals, likely to capture credentials for unauthorized access or account compromise. Infrastructure analysis reveals the domain garden-kiosk-staging-test.pages.dev was registered on May 27, 2026, through Cloudflare Pages, a platform commonly used for both legitimate and malicious hosting. As of the latest scan, VirusTotal reports 0/95 detections, indicating no antivirus engines have flagged the domain yet. However, it appears on one security blocklist, suggesting early-stage detection by at least one threat intelligence source. The domain remains active, with no observed takedown or sinkholing efforts. Mitigation steps for this specific threat type include immediate blocking of the domain at the network perimeter, particularly for endpoints handling sensitive authentication workflows. Security teams should monitor for connections to garden-kiosk-staging-test.pages.dev in proxy logs, SIEM alerts, or EDR telemetry, as these may indicate compromised credentials or ongoing phishing attempts. User awareness training should emphasize the risks of entering credentials on unfamiliar login portals, even if the page appears visually legitimate. Additionally, domain reputation checks should be performed for any subdomains or related infrastructure under the pages.dev namespace to identify potential lateral movement in phishing campaigns.