puresniper-2yl[.]pages[.]dev

PhishDestroy identifies an active credential-harvesting campaign using puresniper-2yl.pages.dev that masquerades as a sniper-game login interface. The site is rated under-investigation due to its current evasion of antivirus detection, but behavioral telemetry confirms data-exfiltration patterns typical of generic-phishing payloads. No detections on VirusTotal against 95 engines remain a concern, and the infrastructure is provisioned by Cloudflare and served from IP 172.66.47.146. This domain was flagged after SSL certificates issued by Google Trust Services were observed terminating on the same IP. Cloudflare Inc. registered the host via Pages.dev, a platform historically abused for rapid site deployment. No historical matches exist on public blocklists, and VirusTotal remains at 1/95 detections despite recent phishing reports. The site exhibits low domain age with high dynamic-content delivery, aligning with typical short-lived phishing landing pages. Organizations should immediately block puresniper-2yl.pages.dev and 172.66.47.146 at the firewall and DNS resolver. Instruct users to avoid entering any credentials into sniper-themed login prompts and to validate domains before authenticating. Reporting the IOC to threat-intel platforms and updating browser-blocklists will help disrupt this campaign. Monitor outbound traffic patterns for POST requests to /login_handler.php to detect compromised endpoints.