spl1-wvn[.]pages[.]dev

PhishDestroy identifies the domain spl1-wvn.pages.dev as an active credential theft phishing site currently under investigation for generic phishing activities. The campaign is live and poses a direct risk to end users through social engineering tactics aimed at harvesting login credentials. As of the latest intelligence, no brand impersonation has been confirmed, but the domain remains active and should be treated as a high-risk threat vector. This domain was flagged by 0 of 95 VirusTotal vendors as of seed 22ca1a, indicating that signature-based detection has not yet caught up with the threat. The domain is registered through Cloudflare, Inc. and resolves to IP address 188.114.96.3. The SSL certificate is issued by Google Trust Services, which may lend an air of legitimacy to unsuspecting users. VirusTotal scans show zero detections at this time, reinforcing the need for proactive blocking mechanisms. Further investigation is required to determine the exact payload, lures, or targeted brands. The current status of spl1-wvn.pages.dev is active and under investigation. Users and organizations are strongly advised to block this domain at the DNS, firewall, or endpoint level immediately to prevent potential credential theft or malware delivery. Given the lack of detections on VirusTotal and the use of Cloudflare’s infrastructure, traditional security measures may not be sufficient. Implement domain reputation filtering, URL rewriting policies, and user awareness training to mitigate exposure. Monitor network traffic for connections to 188.114.96.3 and inspect SSL/TLS handshakes involving this IP. Report any observed activity to your security operations center and threat intelligence teams for further analysis and correlation with ongoing campaigns.