# auth-le-zr-io.pages.dev — SUSPICIOUS

> auth-le-zr-io.pages.dev is a credential theft site detected with 0/95 VirusTotal detections. Avoid entering any login details. Verify domains before clicking.

## Summary
PhishDestroy identifies auth-le-zr-io.pages.dev as a credential theft domain under active investigation. This site mimics legitimate authentication portals to steal usernames and passwords. Attackers often use Cloudflare’s Pages.dev to host spoofed login pages, making it harder for users to spot the deception. The domain was registered through Cloudflare, Inc., resolves to IP 188.114.96.3, and currently holds an SSL certificate issued by Google Trust Services. VirusTotal scans show 0 detections out of 95 engines as of this report, indicating it has not yet been widely flagged despite its malicious nature.


The domain appears to target users expecting secure authentication flows, likely leveraging brand impersonation or fake login forms to harvest credentials. Cloudflare Pages is a legitimate service, but threat actors frequently abuse it to host phishing content due to its free tier and ease of deployment. The domain’s registration details and hosting infrastructure align with common phishing operations that prioritize anonymity and rapid deployment. Users should treat any unexpected authentication prompt from this domain with extreme caution.


If you visited auth-le-zr-io.pages.dev and entered any credentials, immediately change passwords for the affected accounts and enable two-factor authentication where possible. Scan your device for malware using reputable antivirus software, as credential theft sites often deploy keyloggers or session hijackers. Report the incident to the legitimate service being impersonated and monitor accounts for unauthorized access. Avoid interacting with this domain further, and use domain verification tools or browser warnings to block future visits.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 188.114.96.3

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/domains/auth-le-zr-io.pages.dev
- PhishDestroy: https://phishdestroy.io/domain/auth-le-zr-io.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/auth-le-zr-io.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/auth-le-zr-io.pages.dev/
Last updated: 2026-04-05