play-sliks[.]pages[.]dev

Analysis indicates play-sliks.pages.dev is an active brand impersonation page targeting Discord users. The infrastructure suggests a credential harvesting landing page designed to mimic login or engagement flows associated with the Discord platform. The page title 'Play-sliks' does not align with legitimate service branding, indicating likely deceptive UI presentation intended to mislead users into entering account credentials or session tokens. The hosting on Cloudflare edge infrastructure enables rapid deployment and rotation, commonly used in short-lived phishing campaigns.

Technical evidence supports the classification. VirusTotal reports 2/95 security vendors flagging the domain. The domain was created on June 22 2023 and is registered through Cloudflare, Inc. It appears on 2 independent security blocklists and is actively blocked by PhishDestroy and ScamSniffer. DNS resolution points to IP 172.66.44.91 under AS13335 Cloudflare, Inc., with SSL issued via Google Trust Services / WE1. The combination of low but present detection rates, confirmed blocklist presence, and impersonation targeting increases confidence in malicious intent.

Users who interacted with the site should assume potential credential exposure. If Discord credentials were entered, password reset should be performed immediately and session tokens invalidated across all devices. Review account activity for unauthorized logins and revoke active sessions. Browser-stored credentials and autofill data should be cleared, and any connected applications or OAuth authorizations should be audited and removed if suspicious. Endpoint scanning is recommended to ensure no secondary payloads or extensions were installed during interaction.