service-sttart-io[.]pages[.]dev

PhishDestroy identifies service-sttart-io.pages.dev as an active credential phishing domain impersonating a generic service portal. Although the exact brand being mimicked is unclear, the domain is designed to trick users into submitting sensitive login information through a fake service interface. There is no evidence of a specific drainer kit linked to this domain at this time.

Technical analysis reveals that service-sttart-io.pages.dev currently holds an SSL certificate issued by Google Trust Services, which may lend it an appearance of legitimacy. The domain resolves to the IP address 172.66.47.45 and is registered through Cloudflare, Inc. VirusTotal analysis reports 12 out of 95 detection engines flagging this domain, indicating it has not yet been widely recognized as malicious by automated scanners. The domain’s creation date is not explicitly provided in the data, and Google Safe Browsing status along with blocklist counts are not available, complicating immediate risk classification.

The domain remains active and under investigation for its potential threat level. Despite the lack of detections on VirusTotal, the domain’s phishing intent and Cloudflare registration warrant caution. Security teams should monitor this domain for emerging evidence and consider blocking it preemptively to protect users from credential theft. Users are advised not to interact with the domain or submit any personal information until a full risk assessment is completed. Further analysis and threat intelligence updates will be necessary to confirm the domain’s risk posture and inform response strategies.