midnight-live[.]pages[.]dev

PhishDestroy identifies a newly active phishing domain, midnight-live.pages.dev, currently under investigation for generic phishing campaigns. The domain leverages a convincing naming convention likely intended to mimic legitimate streaming or entertainment services, potentially exploiting user trust in well-known platforms. No specific drainer kit or branded impersonation (e.g., Netflix, Disney+) has been confirmed at this stage, but the generic nature of the phishing suggests opportunistic credential harvesting or payment fraud tactics.

This domain was flagged by PhishDestroy with the following technical indicators: a 0/95 VirusTotal detection score, registration through Cloudflare, Inc., and resolution to IP 188.114.97.3. The SSL certificate issued by Google Trust Services indicates an attempt to establish legitimacy, though further analysis is required to determine its issuance date. The domain remains unlisted on Google Safe Browsing (GSB) and has not been added to any major threat intelligence blocklists at this time.

As of now, the domain is classified as active with an under_investigation status, indicating elevated but unconfirmed risk. Immediate actions include continued monitoring for changes in detection rates, blocklist inclusion, or shifts in infrastructure (e.g., IP or SSL certificate rotation). Users are advised to exercise caution when accessing content hosted on midnight-live.pages.dev, avoid entering credentials or payment details, and report any suspicious interactions. The current risk remains dynamic, with potential escalation pending additional intelligence or behavioral analysis.