{"success":true,"data":{"id":"cf-pages-telegram-exfil","label":"Credential phishing page hosted on Cloudflare Pages (*.pages.dev) with credential-harvest narrative","description":"Credential phishing hosted on Cloudflare Pages free tier (*.pages.dev) with account-compromise or suspension narrative, typically exfiltrating credentials to a Telegram bot backend. Cloudflare Pages inherits Cloudflare CDN reputation, causing many URL reputation filters to score *.pages.dev links as benign. The signal fires when: (1) a link to *.pages.dev appears AND (2) a credential/account-action narrative is present (sign in, verify, suspended, restore access) AND (3) sender is NOT from cloudflare.com AND (4) no List-Unsubscribe or In-Reply-To header. Source: GC1 R13 council #4; Group-IB Cloudflare Pages phishing 2025; APWG eCrime platform-abuse track 2025.","tier":"warning","category":"other","isThin":false}}