toyota303baru[.]pages[.]dev

PhishDestroy identifies an active fake Toyota promotional phishing domain, toyota303baru.pages.dev, designed to impersonate a legitimate automotive giveaway. This scam leverages the trusted Toyota brand to lure victims into entering personal or financial details under the guise of claiming a prize. No drainer kit or advanced tooling has yet been identified in this campaign, suggesting a relatively unsophisticated but potentially effective social engineering approach. This domain resolves to IP address 188.114.96.3 and is currently registered through Cloudflare, Inc. using a Let’s Encrypt SSL certificate for added legitimacy. VirusTotal currently shows 0 detections out of 95 scanners, indicating it remains under the radar despite active hosting. The domain is hosted on Cloudflare Pages, a platform often abused by threat actors to rapidly deploy phishing content with minimal traceability. As of the latest analysis, no blocklist entries have been recorded for this domain. The campaign is currently active and under investigation, with PhishDestroy monitoring its status. Users are advised not to interact with the domain or any associated links. While the immediate risk is being assessed, the use of Cloudflare infrastructure and a legitimate SSL certificate increases the likelihood of successful deception. The public is urged to report any encounters with this domain and to verify any unexpected automotive promotions directly through official Toyota channels.