pibrowser-activation[.]pages[.]dev

PhishDestroy identifies pibrowser-activation.pages.dev as a live phishing domain distributing a browser activation scam under investigation for malware distribution. This threat employs counterfeit activation prompts to harvest user credentials and potentially deploy malicious payloads.

This domain was flagged with 15/95 detections on VirusTotal despite active phishing distribution. Registered through Cloudflare, Inc., it resolves to IP 172.66.47.53 and operates under a Google Trust Services SSL certificate. The Campaign ID seed 0394e6 confirms this is part of an emerging campaign tracked since recent domain registration.

To mitigate this browser activation phishing scam, users should avoid interacting with any pibrowser-activation.pages.dev prompts and immediately report the domain. Organizations should block the IP 172.66.47.53 at the firewall level and update browser security policies to block Cloudflare Pages subdomains serving executable content. Security teams should monitor for similar phishing domains using seed 0394e6 patterns.