extravis-reshade-preset-download[.]pages[.]dev

PhishDestroy identifies active phishing on extravis-reshade-preset-download.pages.dev, a Cloudflare-hosted page impersonating Reshade preset downloads. This site masquerades as a legitimate graphics tool repository while distributing malicious payloads or harvesting credentials. Users searching for visual enhancement filters risk downloading compromised files or exposing personal data to threat actors.

This domain was flagged after VirusTotal analysis returned zero detections from 95 security engines, indicating it evades current signature-based detection. Registered through Cloudflare’s pages.dev service on unknown date, the infrastructure resolves to IP 188.114.97.3 and leverages a Google Trust Services SSL certificate to appear legitimate. The absence of detections suggests either a newly deployed campaign or advanced evasion techniques.

If you visited this site, immediately scan your device with updated antivirus software and revoke any saved credentials entered on the page. Do not download files from unexpected sources, even if the site appears authentic. Report the domain to your security team and consider changing passwords for accounts exposed during the visit. Monitor for unusual system behavior or unauthorized access attempts in the coming days.