connect-in-style[.]pages[.]dev

This domain, connect-in-style.pages.dev, is currently under investigation for generic phishing activity, specifically targeting users through brand impersonation tactics. Analysis indicates the site mimics customization services, potentially luring victims into credential harvesting or financial fraud schemes. No specific drainer kit signatures have been identified yet, but the infrastructure aligns with common phishing deployment patterns. Infrastructure analysis reveals the domain was registered on April 27, 2026, through Cloudflare, Inc., and resolves to the IP address 172.66.44.83, hosted in a Cloudflare data center in California. The SSL certificate is issued by Google Trust Services (WE1), a common configuration for both legitimate and malicious sites. VirusTotal reports 0 detections out of 95 engines, suggesting the threat is either new or evasive. The domain appears on one security blocklist, PhishDestroy, and is not currently flagged by Google Safe Browsing. As of this assessment, connect-in-style.pages.dev remains active and accessible. The low detection rate combined with the recent registration date suggests the campaign may still be in its early stages or employing evasion techniques. Users are advised to exercise caution, particularly if prompted for login credentials or payment details. Organizations should monitor for similar domains leveraging Cloudflare Pages infrastructure and consider preemptive blocking of the associated IP range.