fastonward-web-test[.]pages[.]dev

PhishDestroy identifies fastonward-web-test.pages.dev as an active phishing domain hosting a fraudulent 'Fast Forward' login portal, a tactic commonly used to harvest user credentials. The site uses a deceptive domain structure to impersonate a legitimate fast-forward service, targeting victims under the guise of a widely recognized feature. No known drainer kits or advanced evasion toolkits were detected at the time of analysis, but the landing page layout suggests a standard credential-harvesting interface designed to mimic a familiar service prompt.

This domain resolves to IP 188.114.96.3, is registered through Cloudflare, Inc., and operates via a Google Trust Services SSL certificate. As of initial analysis, VirusTotal reports 0 out of 95 detection engines flagged the domain, indicating it remains under the radar of most commercial scanners. The domain is newly registered, showing no prior history, and is not currently flagged in the Google Safe Browsing (GSB) database. It has not yet accumulated entries on major threat blocklists such as PhishTank or OpenPhish.

This domain is actively resolving and serving phishing content as of seed 381329. While no formal takedown has been initiated, the absence of detections suggests a window of opportunity for threat actors. Users are advised to avoid clicking links from unsolicited messages referencing 'fast-forward' services. Domain owners and security teams should consider blocking fastonward-web-test.pages.dev and its resolving IP 188.114.96.3 at the network perimeter. The current risk remains assessed as 'under_investigation', but the lack of detection warrants heightened vigilance until formal mitigation occurs.