soge-on-sol[.]pages[.]dev

This domain, soge-on-sol.pages.dev, is confirmed to host a credential theft portal under the guise of a "Fee Distribution Portal." The site is currently active and designed to harvest user login credentials through deceptive input forms. Analysis indicates the threat is highly targeted, likely impersonating financial or institutional services to exploit trust in fee-related transactions. Infrastructure analysis reveals the domain was registered on April 30, 2026, through Cloudflare, Inc., and resolves to the IP address 188.114.97.3, hosted in Canada under Cloudflare’s network. The SSL certificate is issued by Let’s Encrypt (serial number E8), a common choice for both legitimate and malicious sites. Detection remains limited, with only 1 of 95 VirusTotal security vendors flagging the domain as malicious. The domain appears on a single security blocklist, suggesting early-stage detection or low visibility. No historical ties to known brand impersonation campaigns were identified, but the page title and structure align with credential harvesting tactics. The site remains active as of this report, posing a high risk to users who may mistake it for a legitimate fee distribution service. Organizations and individuals are advised to block the domain at the network level and add the IP 188.114.97.3 to deny lists. Users should be educated to verify domain authenticity before entering credentials, particularly for portals involving financial transactions. Monitoring for additional blocklist inclusions or vendor detections is recommended to track the threat’s evolution.