apps-phanto-walit[.]pages[.]dev

This domain, apps-phanto-walit.pages.dev, is identified as a credential theft operation designed to harvest user login credentials through deceptive login portals. Infrastructure analysis reveals no direct association with known brand impersonation campaigns or crypto drainer kits, but the site employs common phishing tactics such as fake authentication prompts and form submissions to capture sensitive data. The domain exhibits characteristics consistent with credential harvesting, including the use of obfuscated scripts and redirect chains to evade detection. Technical indicators confirm the domain's malicious nature. It is flagged by 10 out of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly labeling it as phishing. The domain resolves to the IP address 188.114.96.3, registered under Cloudflare, Inc., and appears on one security blocklist. Created on November 08, 2025, the domain uses an SSL certificate issued by Google Trust Services (WE1), which, while providing encryption, does not validate the legitimacy of the site. The IP is geolocated in the US, hosted on AS13335, a network frequently utilized for both legitimate and malicious content due to its proxy services. As of the latest assessment, apps-phanto-walit.pages.dev has been taken offline, likely due to enforcement actions by the hosting provider or security entities. However, residual risk remains for users who may have interacted with the domain prior to its deactivation. Affected individuals are advised to reset credentials for any accounts accessed during the exposure window, enable multi-factor authentication, and monitor for unauthorized activity. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts. The infrastructure analysis underscores the need for continuous monitoring of newly registered domains leveraging cloud-based hosting services, as these are frequently abused for short-lived phishing campaigns.