live-welletyu[.]pages[.]dev

The domain live-welletyu.pages.dev is currently active and has been identified as a generic phishing site. Infrastructure analysis shows the domain resolves to the IP address 172.66.44.182 and is hosted behind Cloudflare, Inc., as indicated by the registrar information and the authoritative nameservers adrian.ns.cloudflare.com and jake.ns.cloudflare.com. Cloudflare’s front‑end service masks the true origin of the web server, a common technique used to evade takedown requests and to leverage the provider’s global CDN for rapid content delivery. Reputation checks reveal that the domain is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy feed.

VirusTotal scans report that nine out of ninety‑one antivirus and URL‑reputation engines flag the domain as malicious, confirming a consensus of moderate confidence among security vendors. No additional public threat‑intel platforms such as OTX or Google Safe Browsing have published entries for this host at the time of analysis. Because the page title and content have not been publicly disclosed, the precise brand or service being spoofed remains unknown.

The lack of visible page metadata limits attribution, but the combination of a Cloudflare‑protected host, multiple vendor detections, and blocklist presence strongly suggests a credential‑harvesting operation. Defenders should add the domain and its resolving IP to network‑level deny lists, monitor DNS queries for the domain, and enforce URL filtering policies that block traffic to *.pages.dev subdomains unless explicitly required. Continuous re‑scanning with multi‑engine services is recommended to capture any evolution in the payload or hosting infrastructure.