auth-le-zr-io[.]pages[.]dev

PhishDestroy identifies auth-le-zr-io.pages.dev as a credential theft domain under active investigation. This site mimics legitimate authentication portals to steal usernames and passwords. Attackers often use Cloudflare’s Pages.dev to host spoofed login pages, making it harder for users to spot the deception. The domain was registered through Cloudflare, Inc., resolves to IP 188.114.96.3, and currently holds an SSL certificate issued by Google Trust Services. VirusTotal scans show 0 detections out of 95 engines as of this report, indicating it has not yet been widely flagged despite its malicious nature.

The domain appears to target users expecting secure authentication flows, likely leveraging brand impersonation or fake login forms to harvest credentials. Cloudflare Pages is a legitimate service, but threat actors frequently abuse it to host phishing content due to its free tier and ease of deployment. The domain’s registration details and hosting infrastructure align with common phishing operations that prioritize anonymity and rapid deployment. Users should treat any unexpected authentication prompt from this domain with extreme caution.

If you visited auth-le-zr-io.pages.dev and entered any credentials, immediately change passwords for the affected accounts and enable two-factor authentication where possible. Scan your device for malware using reputable antivirus software, as credential theft sites often deploy keyloggers or session hijackers. Report the incident to the legitimate service being impersonated and monitor accounts for unauthorized access. Avoid interacting with this domain further, and use domain verification tools or browser warnings to block future visits.