io-walet-livse[.]pages[.]dev

The domain io-walet-livse.pages.dev is currently active and has been identified as a generic phishing site. Infrastructure analysis shows the domain is hosted on Cloudflare’s network, resolving to the IP address 172.66.46.250 and using the Cloudflare nameservers kyree.ns.cloudflare.com and oaklyn.ns.cloudflare.com. Registration details indicate the domain was provisioned through Cloudflare, Inc., which is consistent with the observed hosting configuration. The domain is listed on one security blocklist and has been explicitly blocked by the PhishDestroy service, suggesting that security operators have already taken remediation steps.

VirusTotal scans report that 13 of 91 security vendors flag the domain as malicious, providing additional corroboration of its threat status. No public page title, brand target, or specific phishing kit information is available at this time, so the exact content and lure employed by the site remain uncertain. Defenders should add the domain to network and email filtering blocklists, monitor DNS queries for the associated IP address, and consider sinkholing the IP range if feasible. Continuous observation of VirusTotal and other reputation services is advised to capture any changes in detection scores or additional vendor detections.

Because the domain is served from a reputable CDN, traditional IP‑based blocking may be less effective; therefore, domain‑level controls are recommended. Organizations should also educate users about the risk of unsolicited login prompts and encourage verification of URLs before credential entry. The combination of blocklist presence, multi‑vendor detections, and active blocking by PhishDestroy justifies an elevated risk rating and proactive remediation.