mork-metabeta-zilf[.]pages[.]dev

This domain, mork-metabeta-zilf.pages.dev, is confirmed to operate as credential harvesting phishing infrastructure targeting users through deceptive login interfaces. Analysis indicates the site was designed to mimic legitimate authentication portals, capturing entered credentials for unauthorized access to accounts. The threat specifically focuses on harvesting sensitive login details, likely for financial or corporate exploitation. Infrastructure analysis reveals the domain was registered on November 5, 2025, through Cloudflare, Inc., and resolves to the IP address 188.114.96.3, hosted on AS13335. Security vendor detections on VirusTotal reached 17 out of 95 engines, while the domain appears on two independent security blocklists. The SSL certificate is issued by Google Trust Services under the WE1 intermediate, a common configuration for malicious sites leveraging free hosting services. The page title, 'Suspected phishing site | Cloudflare,' further confirms its detection by automated security systems. Users who visited mork-metabeta-zilf.pages.dev should immediately reset credentials for any accounts entered on the site, particularly if reused across platforms. Enable multi-factor authentication where available to mitigate unauthorized access. Monitor linked accounts for suspicious activity, such as unauthorized transactions or login attempts from unfamiliar locations. If corporate credentials were exposed, notify internal security teams to initiate incident response protocols. The domain is currently offline, but related infrastructure may persist; users should remain vigilant for similar phishing attempts.