glaciermontessori-zorototo[.]pages[.]dev

PhishDestroy identifies glaciermontessori-zorototo.pages.dev as a live phishing domain impersonating a Montessori school to steal payment credentials. This domain employs a generic drainer kit designed to mimic legitimate school fee submission forms, targeting unsuspecting parents or guardians. The page leverages Cloudflare’s infrastructure (via pages.dev) to obscure its malicious origin while hosting the scam content on a Let’s Encrypt-validated SSL endpoint. This domain was flagged by PhishDestroy with a threat type classified as generic_phishing and is currently under investigation due to evolving payload dynamics. Technical indicators include a VirusTotal detection score of 0/95, registration through Cloudflare, Inc., and a resolved IP address of 188.114.97.3. The domain’s infrastructure is hosted on Cloudflare Pages, a legitimate service repurposed for malicious hosting. Google Safe Browsing (GSB) has not yet flagged this domain, and blocklist counts remain at zero, indicating a newly active campaign with minimal prior exposure. The domain’s creation date and additional WHOIS details are pending further forensic analysis to determine its registration timeline. The campaign is currently active, with no active takedown measures in place as of this assessment. Users are advised to avoid interacting with this domain or any associated links, as the payload may evolve to include additional malicious modules. Immediate actions include reporting the domain to local cybersecurity authorities and updating network blocklists to prevent further propagation. The remaining risk is classified as high due to the domain’s active status and lack of detection, requiring urgent mitigation to prevent financial fraud targeting unsuspecting victims.