unvc3-cs[.]pages[.]dev

PhishDestroy identifies a credential theft domain hosted at unvc3-cs.pages.dev, currently flagged as an active generic_phishing host under investigation. This platform leverages Cloudflare’s Pages service with Let’s Encrypt SSL to impersonate legitimate services, presenting a credible threat for end-user credential harvesting and session hijacking. This domain was flagged by 7 of 95 VirusTotal vendors at the time of analysis, indicating no automated detection coverage despite its live status. It resolves to ASN 13335 (Cloudflare) on IP 188.114.97.3 and was registered through Cloudflare, Inc., leveraging inexpensive infrastructure favored by threat actors. The domain is currently unresolved in blocklists and maintains strong infrastructure trust scores, reflecting its newer registration and ongoing abuse potential. Organizations and users should block the domain at DNS and perimeter levels, inspect outbound SSL traffic toward 188.114.97.3, and report the domain to Cloudflare Abuse and threat intelligence platforms for takedown acceleration. Given the absence of detection coverage, manual inspection of recent web requests to *.pages.dev hosts is strongly advised to prevent credential compromise.