reruns-tv2[.]pages[.]dev

This domain, reruns-tv2.pages.dev, is flagged as an active credential theft operation targeting users of streaming services. Analysis of the page title, 'Reruns — Your streams keep working after you log off,' suggests an attempt to impersonate legitimate streaming platforms by offering deceptive continuity features. No direct evidence of a crypto drainer kit or specific brand impersonation has been confirmed, but the phrasing aligns with tactics used to harvest login credentials under false pretenses. Infrastructure analysis reveals the following technical indicators: the domain has a VirusTotal detection score of 0/95, indicating no antivirus engines have flagged it as malicious at the time of assessment. It is registered through Cloudflare Pages and resolves to the IP address 172.66.44.123, hosted by a provider in California. The domain was created on March 28, 2026, and currently appears on one security blocklist. The SSL certificate is issued by Let's Encrypt (serial number E7), a common choice for both legitimate and malicious sites due to its accessibility. No Google Safe Browsing (GSB) flags have been recorded for this domain. The domain remains active and accessible, posing an ongoing risk to users who may be lured into entering sensitive information. While it is blocked by at least one security blocklist, the lack of broader detection suggests it may still evade some automated defenses. Users are advised to avoid interacting with the site and to verify the legitimacy of any streaming service claims through official channels. Organizations should monitor for connections to 172.66.44.123 and consider adding the domain to internal blocklists to prevent credential exposure.