faq-wolate-lgr[.]pages[.]dev

PhishDestroy identifies the domain faq-wolate-lgr.pages.dev as a live generic phishing host currently under investigation. Hosted on Google’s Pages platform and leveraging Cloudflare’s infrastructure, the domain mimics legitimate FAQ content to harvest credentials or session tokens from unsuspecting users. No specific brand or drainer kit attribution has been made at this stage, but the page’s deceptive layout suggests a broad credential-harvesting campaign aimed at tricking visitors into submitting sensitive information under the guise of technical support or account verification.

This domain was flagged with a clean 5/95 detection ratio on VirusTotal as of the latest scan. It is registered through Cloudflare, Inc. and resolves to the IP 172.66.44.96. The SSL certificate is issued by Google Trust Services, indicating a plausible HTTPS facade. Creation date and Google Safe Browsing (GSB) listing status remain unverified in public sources; however, blocklist aggregation services show zero current detections. The absence of detections highlights the evasive nature of this infrastructure, which may be newly deployed or carefully rotated to evade early detection.

At present, the domain remains active and is being monitored under ID 366b07. Immediate containment actions include domain reputation tagging and IP-based blocking in enterprise gateways. Users are strongly advised to avoid accessing this URL and to report any related phishing attempts through official channels. While the current risk is classified as under investigation, the combination of zero detections, Google Pages hosting, and Cloudflare fronting elevates the potential for rapid expansion. Organizations should prioritize user awareness training and update browser-based blocklists to preemptively mitigate exposure.