securedapp-connect[.]pages[.]dev

Analysis of securedapp-connect.pages.dev indicates an active credential‑phishing campaign targeting users of a crypto‑related service. The domain, created on February 5 2025, resolves to IP 172.66.44.127, which is owned by AS13335 Cloudflare, Inc. and is located in the United States. DNS is served by norah.ns.cloudflare.com and armando.ns.cloudflare.com, confirming Cloudflare registration. The site presents an HTTP 200 response, employs HSTS, serves content over HTTP/3, and uses Tailwind CSS for styling; the TLS certificate is issued by Google Trust Services under the WE1 root. VirusTotal scans show 2 of 93 security vendors flag the domain, and it appears on one external blocklist. Independent security tools assign a Gridinsoft trust score of 0 / 100 and PhishDestroy lists the domain as blocked. The page title returned is app.secure-page.xyz, but no further content analysis is available. Defenders should block the domain at network perimeter, add the associated IP address to deny lists, and monitor for credential‑stealing attempts targeting crypto platforms. Continuous observation of the domain’s DNS and certificate changes is recommended to detect any pivot or re‑hosting activity.