lerzerw-logor-helps[.]pages[.]dev

This domain, lerzerw-logor-helps.pages.dev, is currently classified as an active generic phishing site with an elevated risk rating. VirusTotal analysis shows that eight out of ninety‑one scanned security vendors have flagged the domain, indicating a moderate consensus of malicious behavior. The domain is served from the Cloudflare network, resolving to IP address 172.66.44.254 and using the authoritative nameservers bart.ns.cloudflare.com and liberty.ns.cloudflare.com.

Registration information confirms the domain was provisioned through Cloudflare, Inc., which is consistent with the observed hosting infrastructure. Google Safe Browsing has marked the site for social engineering, reinforcing the phishing assessment. The domain is listed on a single external security blocklist and has been specifically blocked by the PhishDestroy service, providing additional evidence of its malicious use.

While the available data confirms the presence of phishing indicators, details such as the exact payload, targeted brand, or compromised credentials have not been disclosed in the current intelligence set. Defenders should prioritize immediate containment by adding the domain to network and endpoint deny lists, enforce DNS filtering for the associated IP range, and monitor for any related CNAME or sub‑domain activity within the same Cloudflare account. Continuous re‑evaluation is advised, as threat actors may modify the hosting configuration or launch new campaigns using the same infrastructure.