abstract-source-factory[.]pages[.]dev

Analysis of abstract-source-factory.pages.dev shows a short‑lived credential‑phishing infrastructure that was taken offline before the report date. The domain was registered on February 21 2026 through Cloudflare, Inc., and resolves to the Cloudflare edge address 188.114.96.3, located in the United States and advertised under ASN 13335 (Cloudflare). DNS resolution uses the Cloudflare‑provided authoritative name servers julian.ns.cloudflare.com and lily.ns.cloudflare.com, indicating the attacker leveraged the provider’s privacy‑preserving registration workflow. The site presented an HTTPS certificate issued by Google Trust Services under the WE1 root, confirming a valid TLS chain, while HTTP responses returned a 403 status code, suggesting the content was deliberately blocked or the server was configured to deny access after detection. Header inspection revealed the presence of HSTS, Cloudflare’s reverse‑proxy services, and HTTP/3 support, all typical of modern abuse platforms that rely on reputable CDN services to hide origin infrastructure.

Security‑vendor scans on VirusTotal recorded four detections out of ninety‑three scanners, and the domain appears on a single external blocklist. PhishDestroy has already flagged the site, and the Gridinsoft trust score is 0 / 100, reinforcing the malicious classification. The page title returned by the server is "Abstract Source Factory," but no further content was captured, leaving the exact phishing lure or targeted brand undefined. Consequently, defenders cannot confirm which credential sets were being harvested, nor can they attribute the campaign to a known phishing kit.

Given the observable indicators—recent registration, Cloudflare hosting, valid TLS, low vendor detection count, and existing blocklist entries—security teams should continue to monitor the domain’s DNS and IP footprint for re‑activation. Adding the domain to internal blocklists, configuring web‑gateway filters to drop traffic to the IP range 188.114.96.