zsdr[.]pages[.]dev

This domain, zsdr.pages.dev, is actively engaged in credential theft operations targeting users of Cloudflare services. Analysis indicates the site employs deceptive login portals mimicking legitimate Cloudflare authentication pages, designed to harvest usernames, passwords, and session tokens. The threat actors likely exploit the trust associated with the Cloudflare brand to increase the success rate of their phishing campaigns, particularly targeting developers, IT administrators, and organizations utilizing Cloudflare's suite of services. The use of Cloudflare Pages as the hosting infrastructure further complicates detection, as the domain blends in with legitimate traffic originating from the same platform. Infrastructure analysis reveals the domain was registered on June 01, 2026, through Cloudflare Pages, a platform commonly used for static site hosting. As of the latest assessment, 16 out of 95 security vendors on VirusTotal have flagged this domain as malicious, indicating a consensus among a subset of the security community regarding its harmful nature. The domain appears on one security blocklist, though this number is expected to rise as awareness of the threat increases. The discrepancy between the creation date (2026) and current year suggests either a typo in registration data or an attempt to obfuscate the domain's true age, a tactic occasionally employed by threat actors to evade temporal-based detection rules. Users who have visited zsdr.pages.dev or entered credentials on any page hosted under this domain should assume their login details have been compromised. Immediate steps include revoking any active sessions tied to the affected accounts, enabling multi-factor authentication where available, and monitoring for unauthorized access or anomalous activity. Network administrators are advised to block the domain at the perimeter and review logs for connections originating from internal systems. Given the domain's active status, organizations should treat this as an ongoing threat and prioritize user education to prevent further exposure, particularly among teams with access to Cloudflare or other critical infrastructure accounts.