livemaintenance[.]pages[.]dev

Analysis of the domain livemaintenance.pages.dev indicates it is actively hosting a phishing page targeting users of EVM-based platforms, as evidenced by the page title 'EVM Resolve.' The domain was registered on April 24, 2026, through Cloudflare, Inc., and remains operational as of July 12, 2026. Infrastructure analysis reveals the domain resolves to the IP address 172.66.44.91, geolocated in Canada and associated with Cloudflare's network. Nameservers khalid.ns.cloudflare.com and maleah.ns.cloudflare.com further confirm Cloudflare's role in its hosting infrastructure. The site employs HTTP/3 and HSTS, likely inherited from Cloudflare's default security configurations, and presents a valid SSL certificate issued by Google Trust Services (WE1). Security vendor detections are limited but notable: four of ninety-four engines on VirusTotal flagged the domain as malicious, while Gridinsoft assigns it a trust score of 0/100. The domain appears on one security blocklist, specifically PhishDestroy. The exact nature of the phishing content remains unconfirmed, as no detailed forensic analysis of the page has been conducted. However, the combination of the page title, registration details, and detection metrics suggests a targeted campaign aimed at users of Ethereum Virtual Machine (EVM) compatible services. Defenders should prioritize blocking this domain at the DNS and network levels, particularly in environments where EVM-related transactions occur. Monitoring for connections to 172.66.44.91 and associated Cloudflare IP ranges may help identify compromised systems. Given the domain's recent registration and active status, further scrutiny of similarly structured domains under the pages.dev namespace is recommended. No evidence currently links this campaign to broader threat actor infrastructure, but continued tracking of detection trends is advised.