wwwdan[.]pages[.]dev

Analysis shows that wwwdan.pages.dev is an active credential‑phishing site first observed on 2 April 2026. The domain is hosted on Cloudflare Pages and resolves to the IP address 172.66.47.158, which is associated with Cloudflare, Inc. in Canada. The site presents a valid TLS certificate issued by Google Trust Services under the WE1 root, indicating normal HTTPS operation, and returns HTTP 200 for the indexed page titled “Daniel Nash”. Infrastructure signals include a Gridinsoft trust score of 0 / 100 and presence on a single security blocklist, with PhishDestroy confirming the domain as blocked. VirusTotal has recorded scans from 94 vendors, none of which currently flag the host, but this lack of detections does not constitute a safety assurance. The limited observable data provide no insight into the page’s content or the specific credentials targeted. Consequently, defenders should treat the domain as malicious, enforce blocking at DNS and proxy layers, and monitor outbound connections to the associated IP. Ongoing surveillance is advised to capture any future payload changes or additional indicators of compromise that may emerge as the campaign evolves.