itc-vietnam-hanoi[.]pages[.]dev

Analysis indicates that the domain itc-vietnam-hanoi.pages.dev is an active credential phishing site targeting users of online slot gaming platforms. The domain was registered on April 26, 2026, and remains operational as of July 12, 2026, resolving to the IP address 188.114.97.3, which is associated with Cloudflare's infrastructure in Canada. The page title, 'Situs Login Anti Nawala Link Resmi Slot Gacor JP Beruntun Jaminan Maxwin,' explicitly references 'Slot Gacor,' a term commonly associated with online gambling platforms, suggesting an attempt to deceive users into entering login credentials under the guise of a legitimate gaming site. Infrastructure analysis reveals the domain is hosted on Cloudflare's content delivery network, utilizing nameservers doug.ns.cloudflare.com and ollie.ns.cloudflare.com. The site employs a Let's Encrypt SSL certificate (E8) for encryption, a common tactic among phishing domains to appear legitimate. Technologies detected include AMP, Lightbox, HSTS, and HTTP/3, which are consistent with modern web hosting practices but do not mitigate the malicious intent. The domain has been flagged by at least one security blocklist and is classified as a high-risk credential phishing threat. VirusTotal reports that 2 out of 91 security vendors have detected this domain as malicious, though the absence of broader detection does not imply safety. Defenders should treat this domain as an active threat. Network-level blocking of the domain and its resolving IP (188.114.97.3) is recommended to prevent user exposure. Given the domain's use of Cloudflare, additional monitoring for related subdomains or newly registered domains with similar naming patterns may be warranted. The exact content and functionality of the phishing page remain unanalyzed, but the page title and scam classification indicate it is designed to harvest credentials from unsuspecting users.