root-sol[.]pages[.]dev

PhishDestroy identifies root-sol[.]pages[.]dev as an active phishing domain masquerading as Cloudflare infrastructure to harvest user credentials. The domain leverages Cloudflare Pages to host a spoofed login portal, tricking victims into entering sensitive information under the guise of legitimate authentication. The threat actor behind this campaign appears to be leveraging Cloudflare's trusted reputation to bypass security controls, as evidenced by the domain's SSL certificate issued by Google Trust Services and its resolution to IP 172.66.47.200. This domain was flagged with 0 detections out of 95 VirusTotal scans, highlighting its stealthy nature despite active hosting. Registered through Cloudflare, Inc., the domain's infrastructure aligns with legitimate services, complicating detection efforts. While the exact creation date remains unverified, the lack of blocklist entries suggests this campaign is either newly deployed or deliberately evading traditional defenses. The combination of Cloudflare's Pages service, Google-issued SSL certificates, and unflagged status underscores the sophistication of this phishing attempt. Users who visited root-sol[.]pages[.]dev should immediately review their Cloudflare account for unauthorized access and enable multi-factor authentication (MFA) if not already configured. Avoid entering any credentials or sensitive data on suspicious pages, even if they appear legitimate. Report the domain to your security team and run a full system scan to rule out potential malware infections. For further analysis, consult the full threat advisory linked in this report.