ofertasenmayopost[.]pages[.]dev

ofertasenmayopost.pages.dev is a confirmed phishing domain impersonating retail brands to distribute counterfeit discount coupons via Cloudflare Pages. This campaign specifically targets Spanish-speaking users with fraudulent "oferta especial" (special offer) lures, requesting payment details for alleged shipping fees. The site remains active as of the latest assessment. This domain was flagged by 15 of 95 VirusTotal vendors, is registered through Cloudflare, Inc., and resolves to IP 172.66.44.137 with a Google Trust Services SSL certificate. The page appears to leverage Cloudflare Pages’ free hosting to evade traditional takedown measures while maintaining a veneer of legitimacy through HTTPS. Despite its recent creation, the domain has already accumulated multiple blocklist detections in various threat intelligence feeds. PhishDestroy assesses this phishing attempt as elevated risk due to its combination of HTTPS legitimacy signals, cloud hosting evasion tactics, and targeted social engineering focusing on constrained-time offers. Users who engaged with this page may have submitted sensitive payment information under the guise of processing coupon redemptions. Immediate actions include verifying any recent online transactions, resetting passwords if the same credentials were reused, and reporting the incident to relevant financial institutions. Consumers are advised to ignore unsolicited discount offers and verify promotions directly through official brand channels.