minecraft-download-softonic[.]pages[.]dev

PhishDestroy identifies minecraft-download-softonic.pages.dev as an ACTIVE phishing domain currently under investigation for distributing counterfeit Minecraft downloads. The site masquerades as a legitimate Softonic mirror to trick users into installing malware or stolen credentials stealers. At present no antivirus engines on VirusTotal flag the domain (0/95 detections), but the payload and lures remain untrusted and actively monitored.

This domain was registered through Cloudflare, Inc. using a Google Trust Services SSL certificate to appear legitimate. It resolves to IP 188.114.97.3, a Cloudflare Anycast range known for hosting transient phishing infrastructure. The .pages.dev suffix is part of Cloudflare Pages, a legitimate service that attackers abuse to spin up disposable landing pages quickly. As of the last intelligence sweep, the domain does not yet appear on major blocklists such as PhishTank, OpenPhish, or URLVoid, which often lag hours behind initial deployment. Trust scores from security vendors hover near zero due to the absence of historical reputation and the presence of deceptive download lures.

Mitigation steps specific to this threat focus on prevention and detection. Users should never download Minecraft or other games from third-party mirrors advertising on search ads or unofficial sites. Instead, obtain the official installer directly from minecraft.net and verify the SHA-256 hash against Mojang’s published values. Network defenders can block the IP 188.114.97.3 at the firewall and add the domain minecraft-download-softonic.pages.dev to DNS sinkholes or deny lists. Administrators should also inspect DNS logs for any internal systems resolving to this domain, as compromised hosts may beacon to the IP during malware execution. Given the low antivirus coverage and high deception potential, immediate user education and proactive blocking are recommended to reduce the risk of credential theft and malware infection.