lili-c2e[.]pages[.]dev

PhishDestroy identifies lili-c2e.pages.dev as an ACTIVE malicious domain engaged in PayPal credential harvesting operations. The site currently poses an UNDER INVESTIGATION risk level while automated analysis continues. This is not speculative threat intelligence—this is a live phishing campaign with clear indicators of abuse designed to deceive users into surrendering sensitive financial credentials. Security researchers should treat this domain as hostile and avoid any interaction that could compromise user accounts.

This domain resolves to IP address 172.66.47.95, which is hosted on Cloudflare infrastructure. The domain was registered through Cloudflare, Inc. and currently operates with a valid SSL certificate issued by Google Trust Services (GTS CA 1C3). Despite deploying HTTPS encryption, VirusTotal analysis reveals 0 out of 95 security engines currently flag this domain as malicious. The domain appears to be a newly created subdomain within the pages.dev namespace, which has become a favored vehicle for phishing campaigns due to Cloudflare’s free hosting services. As of this analysis, the domain remains unlisted on major blocklists including PhishTank, OpenPhish, and Google Safe Browsing. Trust scores remain neutral across threat intelligence platforms, indicating this campaign has successfully evaded early detection mechanisms.

Mitigation for this PayPal credential harvesting campaign requires immediate action from both end users and security teams. Users should immediately block access to lili-c2e.pages.dev at the network level and verify that no saved credentials exist for PayPal or associated financial services on any device that may have accessed this domain. Organizations should implement browser policies blocking Cloudflare Workers subdomains (pages.dev) unless explicitly whitelisted, as threat actors increasingly exploit this platform for phishing due to its legitimate appearance and dynamic content delivery. Security teams should also audit authentication logs for any suspicious login attempts originating from this domain’s IP address (172.66.47.95) or associated user agents. Given the current 0/95 VirusTotal detection rate, proactive hunting based on domain patterns (such as *.pages.dev with PayPal-themed content) is essential to prevent credential theft before automated detection improves.