verify-badge-vip20[.]pages[.]dev

This domain, verify-badge-vip20.pages.dev, is identified as a credential phishing infrastructure designed to harvest user login credentials through deceptive authentication prompts. Analysis indicates the site impersonates a legitimate verification service, likely targeting users under false pretenses of account validation or badge verification. The threat type is classified as credential phishing, with a focus on capturing sensitive authentication details for unauthorized access. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on June 12, 2026, and resolves to the IP address 188.114.97.3. It is flagged by 14 of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. The domain appears on one security blocklist and is explicitly blocked by PhishDestroy. Technical indicators include the use of HTTP/3, HSTS, and a Google Trust Services SSL certificate, which may lend a false sense of legitimacy to unsuspecting users. The creation date suggests the domain was established with malicious intent, as it predates typical registration timelines for legitimate services. As of the latest assessment, verify-badge-vip20.pages.dev has been taken offline, though residual risks may persist. Organizations and users are advised to block the domain and its associated IP address (188.114.97.3) at the network level. Security teams should monitor for any attempts to reuse the infrastructure or domain name under alternative top-level domains. End users should be educated on recognizing credential phishing tactics, particularly those leveraging fake verification prompts. If credentials were entered on this site, immediate password resets and multi-factor authentication reviews are recommended for all affected accounts.