hom---wallltt---liivee--ledgrr[.]pages[.]dev

PhishDestroy identifies a live credential-theft phishing site hosted at homwalllttliveeledgrr.pages.dev that masquerades as a login portal to harvest usernames and passwords. Attackers register look-alike domains, add a free Cloudflare SSL certificate to appear legitimate, and then send links via email or social media in hopes that victims will submit their credentials. Once captured, stolen logins are either sold on underground forums or used in account-takeover attacks against other services where the same password has been reused. This domain is still active and remains undetected by all 95 VirusTotal engines as of the latest scan. This domain was flagged by PhishDestroy on seed c37670 after it registered 0 detections at VirusTotal on 172.66.44.119, a Cloudflare IP. The site uses Google Trust Services to serve an SSL certificate, which is common for both legitimate and malicious pages because it provides the familiar padlock icon without cost. Despite the SSL layer, the site’s structure—pages.dev subdomain, excessive repeated letters in the name, and lack of any corporate imprint—strongly indicates a phishing construct designed for quick deployment and takedown evasion. Registrant data is hidden behind Cloudflare’s privacy service, preventing direct owner identification at this time. If you visited homwalllttliveeledgrr.pages.dev, assume your credentials may have been captured. Immediately change the password on that account and any other site where you reused the same login. Enable multi-factor authentication wherever possible to block further unauthorized access. Report the domain to your email provider or browser so filters can be updated, and run a malware or password-reuse scan on your device to check for secondary infections. Do not reuse the exposed password on any other account, even if the service claims the breach is resolved.