project--live-app[.]pages[.]dev

PhishDestroy identifies project--live-app.pages.dev as an active credential theft phishing domain impersonating a live application service. The domain is currently engaged in a phishing campaign designed to harvest user credentials under the guise of a legitimate application interface. Analysis confirms the domain remains active and poses an immediate risk to users who may interact with it.

This domain was flagged by 6 of 95 VirusTotal vendors at the time of analysis, indicating it has evaded detection by major antivirus engines. The domain is registered through Cloudflare, Inc., resolves to IP address 172.66.44.212, and utilizes a Google Trust Services SSL certificate. No historical blocklist entries or trust score metrics are available at this stage, as the domain remains under active investigation with no prior detections in public threat intelligence feeds.

The domain remains active and should be considered a high-risk threat until further evidence suggests otherwise. Users are advised to avoid accessing project--live-app.pages.dev and report any interactions to their security teams. Organizations should implement network-level blocking for the IP address 172.66.44.212 and the domain itself. Security teams are encouraged to monitor for any additional infrastructure tied to this campaign and update threat intelligence platforms with these indicators. Proactive user awareness training on recognizing credential harvesting attempts is strongly recommended.