izin-lewat-pak[.]pages[.]dev

This domain is flagged under investigation for hosting a targeted phishing operation masquerading as a legitimate online gambling platform. Analysis indicates the site specifically impersonates 'SLOT GACOR,' a fraudulent service promising rapid financial transactions to deceive users into disclosing credentials or transferring funds. The threat type falls under credential harvesting and financial fraud, with potential secondary risks including malware distribution through fake download prompts or malicious redirects embedded in the site infrastructure. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 172.66.47.97, hosted on Cloudflare's network (AS13335) in the United States. The domain was registered through Cloudflare, Inc. with an anomalous creation date of May 27, 2026, suggesting potential domain spoofing or registry manipulation. VirusTotal returns 0 detections out of 95 engines, indicating low immediate detection rates despite its presence on one security blocklist. The SSL certificate is issued by Let's Encrypt (serial number E8), providing HTTPS encryption that may lend false legitimacy to the phishing page. The page title explicitly advertises 'SLOT GACOR | Platform Resmi Terpercaya Menawarkan Sistem Deposit Kilat dan Withdraw Instan,' a clear social engineering lure targeting Indonesian-speaking users. Mitigation requires immediate action from network defenders and end users. Organizations should implement DNS-level blocking for izin-lewat-pak.pages.dev and its resolving IP 172.66.47.97, with particular attention to Cloudflare-hosted domains exhibiting gambling-related content. Endpoint protection systems should be updated to flag the domain's SSL certificate fingerprint (Let's Encrypt E8) and monitor for connections to AS13335. Users should be educated to recognize the specific lures used in this campaign, including promises of 'instant withdrawals' and 'trusted platforms,' which are common indicators of financial phishing. Financial institutions should monitor for transactions originating from this domain's infrastructure and implement additional verification steps for users reporting interactions with the site. Given the domain's active status and low detection rates, continuous monitoring of related infrastructure is recommended to identify potential pivot domains or IP shifts.