dwnledg[.]pages[.]dev

PhishDestroy identifies dwnledg.pages.dev as a confirmed malicious file download phishing domain currently active and under investigation. This domain is not merely a generic phishing site; it specifically hosts a lure designed to trick users into downloading malicious files under false pretenses. The threat is classified as active, with no indication of remediation at this time.

This domain was flagged by 10 of 95 VirusTotal detection engines as of the latest scan, indicating no current antivirus coverage. It is registered through Cloudflare, Inc., resolving to IP address 172.66.47.28. While the SSL certificate is issued by Google Trust Services—suggesting an attempt to appear legitimate—the absence of VirusTotal detections and the nature of the payload suggest a newly deployed or evasive threat. The domain is part of the Cloudflare Pages platform, which is frequently abused by threat actors to host phishing content rapidly and with minimal overhead.

Given the confirmed malicious file download objective and current lack of detection, users and organizations are strongly advised to block access to dwnledg.pages.dev at the network perimeter and avoid interaction. Security teams should inspect DNS logs for requests to this domain and search endpoint telemetry for signs of download attempts or subsequent payload execution. All inbound emails referencing file downloads from this domain should be treated as malicious and quarantined. Users who may have visited the site should scan their devices for unauthorized downloads and run a full antivirus scan. This threat is under active monitoring, and updates will be provided as new intelligence emerges.