networkchains-8wb[.]pages[.]dev

PhishDestroy identifies a credential-harvesting campaign hosted at networkchains-8wb.pages.dev that mimics corporate login portals to steal Microsoft 365 credentials. The page is served over HTTPS via Cloudflare Pages, resolving to IP 188.114.97.3 and has evaded detection by all 95 VirusTotal engines so far. Visitors entering any credentials are immediately transmitted to attacker-controlled infrastructure, risking account takeover and lateral movement in cloud environments.

PhishDestroy’s investigation confirms this domain was registered through Cloudflare, Inc. and shows zero detections on VirusTotal as of the latest scan. The page was built on Cloudflare’s Pages platform and currently points to the Cloudflare IP range 188.114.97.3 with no additional infrastructure enrichment yet visible. Because Cloudflare Pages allows rapid deployment of spoofed login pages, threat actors can iterate campaigns faster than traditional hosting providers, increasing the likelihood of successful credential collection before detection occurs.

If you visited networkchains-8wb.pages.dev and entered any credentials, assume your Microsoft 365 or related corporate account has been compromised. Immediately change your password using a known-clean device, enable multi-factor authentication if not already enabled, and report the incident to your IT security team. Scan recent sign-in logs for anomalous activity and revoke any unrecognized sessions or OAuth tokens. Do not reuse the exposed password on other systems. Forward the URL or any screenshots to your security team for forensic analysis and indicator-of-compromise extraction.