subscriberfraudinvestigation[.]pages[.]dev

subscriberfraudinvestigation.pages.dev has been confirmed as an active fraud investigation scam masquerading as a subscriber fraud detection portal. This domain is weaponized to trick users into divulging sensitive account credentials or payment details under the pretense of resolving alleged subscription fraud. The threat is elevated due to its operational status and the potential for immediate financial harm to victims who engage with the malicious content. This domain was flagged on VirusTotal with a detection ratio of 1 out of 95 security vendors, indicating limited but existing recognition of its malicious nature. It is registered through Cloudflare, Inc., a common provider for malicious infrastructure due to its privacy protections and ease of domain creation. The domain resolves to IP address 172.66.44.210, which is associated with Cloudflare's infrastructure. The SSL certificate is issued by Google Trust Services, a trusted authority, which may lull victims into a false sense of security by appearing legitimate. This domain is hosted on Cloudflare Pages, a legitimate service often abused for phishing campaigns due to its fast deployment capabilities and built-in CDN. To mitigate exposure to this scam, users should avoid clicking links from unsolicited emails or messages referencing subscriber fraud investigations. Organizations are advised to block access to this domain at the network perimeter and educate employees about the tactics used in such fraud investigation scams. Security teams should monitor for similar domains leveraging Cloudflare Pages or Google Trust Services certificates as part of their threat hunting efforts.