# PhishDestroy threat dossier — harmful.pages.dev ================================================================ Fetched: 2026-05-03 16:09:05 UTC Canonical: https://phishdestroy.io/domain/harmful.pages.dev/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 92/100 (PhishDestroy scoring — see methodology below) Scam classification: Impersonation Targeted brand: Microsoft ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 0/91 security vendors flagged this domain ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 172.66.44.238 (CA, Toronto) ASN: AS13335 Cloudflare, Inc. Hosting org: Cloudflare, Inc. Registrar: Cloudflare, Inc. Nameservers: damian.ns.cloudflare.com, leia.ns.cloudflare.com Registered: 2026-05-01 Page title: Security Warning - Microsoft SmartScreen HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Google Trust Services / WE1 Expires: 2026-07-29 Status: INVALID chain Fingerprint: bfc78871f2e347b553a51cf9f11808b3772ccdc18b53916f73df6d2c46a3ff6b ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-05-01 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-05-01 03:56:32 UTC (by PhishDestroy tracker) Last verified: 2026-05-03 03:14:01 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019de108-b7de-754c-8eab-2802b47cedcb/ Wayback Machine: https://web.archive.org/web/*/harmful.pages.dev crt.sh CT logs: https://crt.sh/?q=%25.harmful.pages.dev Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=harmful.pages.dev AlienVault OTX: https://otx.alienvault.com/indicator/domain/harmful.pages.dev URLhaus: https://urlhaus.abuse.ch/host/harmful.pages.dev/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-05-01 03:57:43 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies harmful.pages.dev as an active fake login portal phishing domain designed to steal user credentials under the guise of a legitimate service. This threat involves a fraudulent web page that mimics a login interface, often targeting unsuspecting users to harvest usernames and passwords. The domain leverages Cloudflare’s infrastructure, including its SSL certificate from Google Trust Services, to appear legitimate, making it harder for users to discern its malicious nature. Analysis shows the site resolves to IP address 172.66.44.238 and remains undetected by security vendors, with VirusTotal reporting 0 detections out of 95 scans as of the latest assessment. This domain was flagged due to its role in a phishing campaign targeting login credentials, a common tactic used by cybercriminals to gain unauthorized access to personal accounts. The phishing page is hosted on Cloudflare’s platform, a trusted web infrastructure provider, which complicates detection efforts. The SSL certificate issued by Google Trust Services adds a veneer of legitimacy, as users often associate HTTPS with safe browsing. Despite these deceptive measures, the domain remains unblocked by reputable threat intelligence feeds, increasing the risk of exposure to unsuspecting victims. Additionally, the domain’s recent registration through Cloudflare suggests a short operational lifespan typical of phishing campaigns. Users who have visited harmful.pages.dev or suspect interaction with this fake login portal should immediately change any passwords they may have entered. Disconnect from the site and run a full antivirus scan to detect and remove any potential malware. Consider enabling two-factor authentication on all critical accounts as an added layer of security. Report the domain to your browser’s phishing reporting tool or via platforms like Google Safe Browsing to help prevent further victimization. Staying vigilant and verifying the legitimacy of websites before entering credentials is crucial to mitigating this threat. ## EVIDENCE HASHES ---------------------------------------------------------------- TLS cert SHA-256: bfc78871f2e347b553a51cf9f11808b3772ccdc18b53916f73df6d2c46a3ff6b ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/harmful.pages.dev/ JSON API: https://api.destroy.tools/v1/check?domain=harmful.pages.dev Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 145,177 domains (56,093 alive under monitoring, 88,811 confirmed takedowns/dead). Site: https://phishdestroy.io