enlist-mojoplanet1[.]pages[.]dev

The domain enlist-mojoplanet1.pages.dev is currently active and has been classified as a brand‑impersonation campaign targeting Google. The site presents the page title "Planet Mojo" and was registered on April 9 2024 through Cloudflare, Inc. It resolves to IP 188.114.96.3, an address owned by AS13335 Cloudflare, Inc., and serves a TLS certificate issued by Google Trust Services / WE1, indicating a legitimate‑looking HTTPS posture. Technical fingerprints show the use of YouTube embeds, the Stimulus JavaScript framework, Unpkg, SweetAlert2, jsDelivr, HSTS headers, crypto‑js, and cdnjs libraries, all of which are common in commodity phishing kits. The domain appears on two public blocklists (PhishDestroy and ScamSniffer) and has a Gridinsoft trust score of 0 / 100, reflecting a high confidence of malicious intent. VirusTotal analysis reports a single vendor detection out of 91, further supporting the suspicion. No additional content analysis is available beyond the page title, so the exact luring vector and credential‑capture mechanisms remain uncertain. Defenders should add enlist-mojoplanet1.pages.dev to DNS and URL filtering policies, monitor outbound traffic to the associated Cloudflare IP range, and consider isolating any internal users who may have accessed the site. Continuous threat‑intel feeds should be consulted for any emerging indicators tied to the same infrastructure, and incident response procedures should be prepared in case credential or session data is exfiltrated from affected endpoints.