vejezo[.]pages[.]dev

PhishDestroy identifies vejezo.pages.dev as a generic phishing domain currently under investigation with an active status. The domain is engineered to mimic legitimate services and lure users into exposing sensitive credentials through deceptive login portals. Due to the generic nature of observed lures and the absence of publicly documented IOCs, this threat remains in flux, warranting heightened caution for anyone encountering the domain.

This domain was flagged via seed 616894 and resolved to IP 172.66.44.124, registered through Cloudflare, Inc. using their Pages platform. The SSL certificate is issued by Let’s Encrypt, enabling encrypted traffic to obscure malicious intent. As of the latest scan, VirusTotal reports 12 out of 95 detections, indicating it remains under the radar of mainstream security engines. No entries appear on major blocklists at this time, and no trust scores are compromised due to the domain’s newness and minimal footprint. Given its recent creation and cloaking behind Cloudflare’s infrastructure, the attack surface is elevated—users interacting with vejezo.pages.dev risk credential harvesting or malware delivery via embedded scripts.

To mitigate exposure, users should immediately block access to vejezo.pages.dev and avoid clicking embedded links or entering credentials on any page hosted there. Administrators are advised to push IOCs (IP 172.66.44.124, domain vejezo.pages.dev, and SSL issuer Let’s Encrypt CN: R3) into network defenses to preempt lateral movement. Cloudflare Pages deployments should be treated with scrutiny; validate all incoming redirects and sandbox unknown *.pages.dev subdomains. Continuous monitoring for newly observed C2 endpoints under this infrastructure is recommended until the investigation concludes.