hoytlawyers-part1[.]pages[.]dev

PhishDestroy identifies Hoytlawyers-part1.pages.dev as a recently activated brand impersonation site masquerading as a law firm landing page. The threat actor is using a Cloudflare Pages subdomain to cloak a credential theft frontend targeting visitors with fake intake forms. No crypto drainer kit or JavaScript payload has been confirmed in telemetry so far, indicating early-stage deployment but high potential for rapid evolution toward a drainer configuration. This domain was flagged by PhishDestroy at 1/95 VirusTotal detections as of the last scan. Registrant details are obscured via Cloudflare, Inc., the listed registrar, while the site resolves to IP 188.114.96.3 on a Let’s Encrypt SSL certificate. Creation timestamps point to early July 2024; the domain remains unclassified by Google Safe Browsing and is currently absent from major real-time blocklists, leaving a brief window for additional victims. Status is active and under investigation; no takedown actions have been completed. Users should block 188.114.96.3 at the firewall and refrain from visiting Hoytlawyers-part1.pages.dev or submitting any credentials to the fake intake form. Remaining risk is elevated due to zero detections and the credible branding decoy.