product-live-download[.]pages[.]dev

PhishDestroy identifies product-live-download.pages.dev as a malicious domain actively distributing fake software update installers, likely as part of a credential harvesting campaign. This domain mimics legitimate update portals to trick users into downloading counterfeit software packages. Analysis reveals this domain remains undetected by security engines, with VirusTotal scoring 2 out of 95 detections despite clear malicious intent. The infrastructure leverages Cloudflare’s Pages.dev platform with an SSL certificate issued by Google Trust Services, while resolving to IP 188.114.96.3. Notably, this domain has not yet been flagged by any blocklists, highlighting the importance of proactive threat hunting. Users who accessed this domain should assume exposure and avoid entering any credentials or downloading files. Immediately scan all devices connected to the same network for signs of compromise, including unusual processes or unauthorized data exfiltration. Report the incident to your security team and revoke any credentials entered on the page. Consider blocking the domain and its IP at the network perimeter to prevent further compromise.