llvaz[.]pages[.]dev

This domain, llvaz.pages.dev, is actively engaged in credential harvesting through a phishing scheme masquerading as a movie streaming platform. The site presents itself as a legitimate source for free, high-definition films, using the page title 'llvaz热播电影-高清电影大全-免费电影在线观看 - 天堂电…' to lure victims. Analysis indicates the domain is designed to capture login credentials, payment details, or other sensitive information under the guise of account verification or subscription access for purported free content. Infrastructure analysis reveals the domain is hosted on Cloudflare infrastructure, resolving to the IP address 172.66.44.77, which is registered under AS13335 (Cloudflare, Inc.). The domain was created on November 16, 2025, an unusually future date suggesting potential obfuscation or misconfiguration. It is flagged by 1 out of 95 security vendors on VirusTotal, indicating limited but confirmed detection. The domain appears on one security blocklist and is currently classified as active. The SSL certificate is issued under the identifier WE1, further linking it to Cloudflare’s provisioning systems. Users who have visited llvaz.pages.dev or interacted with its content should immediately cease all engagement and perform a security review. Any credentials entered on the site must be considered compromised and should be changed across all platforms where reused. Network administrators are advised to block the domain and its resolving IP (172.66.44.77) at the perimeter. If financial information was submitted, affected parties should monitor accounts for unauthorized transactions and report the incident to relevant fraud prevention authorities. No further interaction with the domain should occur, as it remains an active threat.