main-1of[.]pages[.]dev

PhishDestroy identifies main-1of.pages.dev as a malicious site hosting a credential-stealing fake login portal. When users enter their username and password, the site immediately harvests the credentials and may relay them to an attacker-controlled server. Researchers first observed this threat on or around June 3, 2025, and it remains actively hosted on Cloudflare Pages with a Google Trust Services SSL certificate issued to the domain itself.

This domain was flagged after zero out of ninety-five industry antivirus engines on VirusTotal currently detected it, highlighting the need for proactive checks by site visitors. The page uses Cloudflare’s IP 188.114.96.3 and resolves via a Google-issued certificate, giving it a legitimate appearance while concealing its malicious behavior. The combination of freshly registered infrastructure and low detection rates suggests this is a new campaign targeting unsuspecting users.

If you visited main-1of.pages.dev, change any passwords entered on the site immediately and enable multi-factor authentication wherever possible. Use a reputable password manager to audit saved credentials and scan your device with up-to-date antivirus software. Report the domain to your browser’s safe-browsing program to help protect others. Stay alert and verify URLs carefully before entering sensitive information.