new-lezr-en-liv[.]pages[.]dev

PhishDestroy identifies new-lezr-en-liv.pages.dev as a live credential theft domain actively engaged in brand impersonation campaigns. The site leverages Cloudflare’s Pages.dev infrastructure to mimic a trusted service, deceiving users into surrendering login credentials or personal data. Analysis confirms SSL encryption via Google Trust Services (AS396981, 172.66.47.42), which provides a false sense of security despite the malicious intent. Threat actors have configured the domain to harvest credentials under the guise of a service update or verification process, a common tactic in active phishing operations targeting enterprise and consumer accounts alike.

This domain was flagged with 0 detections out of 95 VirusTotal scanners as of the latest scan, indicating it currently evades signature-based detection. The domain is registered through Cloudflare, Inc., a hosting provider often abused for its fast provisioning and traffic obfuscation capabilities. Intelligence indicates the domain resolves to IP 172.66.47.42, a known Cloudflare edge node frequently used in low-duration phishing campaigns. Given its active status and lack of detection coverage, the risk of exposure to unsuspecting users remains high, particularly in contexts where brand confusion is plausible.

Users who accessed new-lezr-en-liv.pages.dev should immediately audit any credentials entered and revoke access to connected applications. Change passwords for the targeted brand or service, and enable multi-factor authentication where available. Report the domain to your IT team or security provider and consider using a browser extension that blocks known malicious domains. Monitor accounts for unusual activity and be cautious of any unexpected login prompts or service notifications. Stay vigilant—brands are frequently impersonated, and only verified domains (HTTPS with correct branding) should be trusted with sensitive data.