io-leadjr-starts[.]pages[.]dev

PhishDestroy identifies io-leadjr-starts.pages.dev as an active credential theft endpoint hosted on Cloudflare Pages. The domain mimics a legitimate [REDACTED] service, suggesting a targeted impersonation campaign designed to harvest user login credentials. No drainer kit artifacts are visible at this stage; however, the rapid deployment on a reputable CDN indicates an attempt to bypass traditional network defenses by leveraging cloud infrastructure trust.

This domain was flagged via seed af94d2. Technical indicators include a 6/95 VirusTotal detection ratio, registration through Cloudflare, Inc., resolution to IP 172.66.47.203, and an SSL certificate issued by Google Trust Services. The domain resolves via Cloudflare’s proxy network, obscuring the origin server and complicating takedown efforts. As of current analysis, no entry exists in Google Safe Browsing (GSB) or major blocklists, highlighting a window of exposure before widespread recognition.

Current status remains active with low detection coverage. Urgent remediation includes DNS-level blocking of the domain and IP, user advisories to avoid interaction, and escalation to Cloudflare Trust & Safety for content removal under phishing policy. Remaining risk is moderate due to unflagged status and reliance on fresh domain age. Continuous monitoring is required as this campaign may expand targeting or infrastructure to increase success rate.