48410b52[.]formartt[.]pages[.]dev

Analysis of the domain 48410b52.formartt.pages.dev indicates it was a credential phishing site flagged by multiple security mechanisms before being taken offline. The domain resolved to 172.66.47.179, an IP address assigned to Cloudflare, Inc. (AS13335) in the United States. Infrastructure analysis reveals the domain was registered through Cloudflare and hosted on its Pages platform, utilizing Cloudflare's HTTP/3 and HSTS technologies. The SSL certificate was issued by Google Trust Services (WE1), a common certificate authority for legitimate and malicious sites alike. At the time of assessment, the domain returned an HTTP 403 status, and the page title displayed 'Suspected phishing site | Cloudflare,' suggesting Cloudflare's automated systems or human reviewers had already identified and restricted access.

Google Safe Browsing classified the domain under 'social engineering,' a category encompassing deceptive sites designed to trick users into divulging sensitive information. The domain appeared on at least one security blocklist and was blocked by PhishDestroy, a specialized anti-phishing service. Gridinsoft assigned a trust score of 0/100, reflecting high confidence in its malicious nature. While the exact content of the phishing page remains unanalyzed, the scam type was categorized as credential phishing based on available intelligence. No nameservers were detected, which may indicate an incomplete or hastily configured deployment.

Sixteen of the security vendors scanning the domain on VirusTotal flagged it as malicious, though the absence of additional context limits the granularity of this data. Defenders should treat this domain as a confirmed phishing threat and ensure it is blocked at the network and endpoint levels. Monitoring for related infrastructure, such as newly registered domains under formartt.pages.dev or IPs within Cloudflare's AS13335 range, may help identify follow-up campaigns.