lyrona-haven[.]pages[.]dev

Analysis of lyrona-haven.pages.dev indicates that the domain was registered on 17 November 2025 through Cloudflare, Inc. The authoritative name servers listed are bruce.ns.cloudflare.com, brynne.ns.cloudflare.com, ns.cloudflare.com and ns2.cloudflare.com, confirming that the domain is hosted on Cloudflare’s infrastructure. DNS resolution points to IP address 172.66.47.112, which belongs to AS13335 Cloudflare, Inc. and is geolocated to the United States. The site presented the page title “Suspected phishing site | Cloudflare” and returned an HTTP 403 response, suggesting that the content was blocked or taken offline at the time of analysis. TLS termination is performed by Google Trust Services under the WE1 certificate, and the connection is protected by HSTS and HTTP/3, reflecting modern security configurations typical of Cloudflare‑hosted sites.

Threat intelligence flags the domain as a generic phishing case with a brand‑impersonation focus. On VirusTotal, 15 of 95 scanned security vendors marked the domain as malicious, and it appears on a single blocklist (PhishDestroy). Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious assessment. The overall risk level is elevated, and the current status is offline, indicating that the phishing infrastructure has been taken down or is no longer serving content.

Uncertainty remains regarding the specific brand being spoofed, as the page title does not disclose a target and no additional payload or landing‑page details are available. Analysts should continue monitoring the associated IP address and Cloudflare name servers for re‑use, and incorporate the domain into blocklists and URL filtering policies. Defensive actions include denying outbound connections to the resolved IP, enforcing DNS sink‑holing for the domain, and updating endpoint protection signatures to reflect the 15 positive detections reported by VirusTotal.