portfolio-b9y[.]pages[.]dev

This domain, portfolio-b9y.pages.dev, operates as a credential-harvesting phishing site disguised as a legitimate design portfolio under the title Clarkybox Design. Analysis indicates the page targets users by presenting a seemingly authentic interface to capture login credentials, likely for subsequent unauthorized access to personal or corporate accounts. The threat specifically exploits trust in professional portfolio displays, making it particularly effective against individuals in creative industries or those seeking design services. Infrastructure analysis reveals the domain was registered on April 09, 2022, through Cloudflare, Inc., and currently resolves to the IP address 188.114.97.3, geolocated to a hosting provider in Canada. The site remains active despite being listed on one security blocklist, with a VirusTotal detection score of 0 out of 95 engines. The SSL certificate, issued by Google Trust Services (WE1), further lends a false sense of legitimacy to the malicious page, while the lack of detections suggests evasion techniques or recent deployment. Users who have visited portfolio-b9y.pages.dev and entered credentials should immediately revoke access to any accounts potentially exposed, enable multi-factor authentication where available, and monitor for unauthorized activity. Network administrators are advised to block the domain and associated IP address (188.114.97.3) at the perimeter. If browser sessions were initiated, clear cached data and reset passwords for all accounts accessed during the suspected compromise window. Given the domain's low detection rate, manual verification of any linked resources is recommended to avoid further exposure.