yield-basis-1760902402851-fjaigbm3[.]pages[.]dev

PhishDestroy identifies an active phishing domain, yield-basis-1760902402851-fjaigbm3.pages.dev, which currently impersonates a legitimate login portal to harvest user credentials. The kit is deployed on Cloudflare Pages and leverages Google Trust Services’ SSL certificate to appear authentic. At the time of analysis, this infrastructure resolved to IP address 172.66.46.221 with no antivirus detections across 95 VirusTotal scanners, indicating a recently launched campaign still under the radar.

This domain was flagged through automated analysis revealing generic phishing behavior targeting unsuspecting users. The site was registered via Cloudflare, Inc., and first observed on September 17, 2024, according to passive DNS data. Despite its fresh appearance, the absence of detections suggests attackers may be cycling new domains to evade blacklists, making it critical for users to verify site authenticity before entering credentials.

If you accessed this site or entered any information, immediately change all passwords used on the page, enable multi-factor authentication where possible, and scan your device for malware. Report the domain to your security team or platform provider. Avoid clicking suspicious links in emails or messages and verify URLs by hovering over links or visiting official websites directly.