clinsightcore2[.]pages[.]dev

PhishDestroy confirms clinsightcore2.pages.dev is actively weaponized for fake-clinic phishing. The domain masquerades as a legitimate healthcare insight portal to harvest patient credentials and payment card details via deceptive login forms and fake appointment schedulers. Visitors presented with fraudulent “Clinic Insight” branding are redirected to credential-harvesting pages hosted on 172.66.47.157, Cloudflare’s Pages.dev platform, which allows rapid domain spin-up and evasion of traditional takedowns. This domain was flagged by PhishDestroy using seed b33fb3; VirusTotal analysis shows zero detections out of 95 engines as of the latest scan, the registrar is Cloudflare, Inc., and the Google Trust Services SSL certificate indicates the site leverages legitimate infrastructure to appear benign. The absence of blocklist entries suggests this campaign is newly active and still under detection radar. Historical WHOIS data shows the domain was created within the last 30 days, confirming its recency and aggressive deployment cycle. If you visited clinsightcore2.pages.dev or entered any information, immediately change passwords used on the site and monitor financial accounts for unauthorized transactions. Disconnect any devices that may have transmitted data to the domain. Report the incident to your bank or payment provider and file a complaint with the FBI IC3 (ic3.gov) and FTC (reportfraud.ftc.gov). Disable autofill for forms on this domain and clear cached credentials to prevent credential-stuffing attacks.