download-en-us-live[.]pages[.]dev

PhishDestroy identifies download-en-us-live.pages.dev as an active phishing domain engaged in tech support scam operations. This subdomain leverages Cloudflare’s Pages.dev infrastructure to deliver fraudulent technical-support pop-ups, tricking users into calling a toll-free number under false pretenses of system compromise. The campaign is currently under investigation but remains operational as of seed 265d17. This domain resolves to IP address 172.66.44.98 and is registered through Cloudflare, Inc. It operates with a Google Trust Services SSL certificate, adding superficial legitimacy. Despite appearing on zero of 95 VirusTotal engines, the site has not yet been blacklisted by major security vendors. This suggests a newly emerged or rapidly evolving threat. The combination of a free Cloudflare Pages subdomain, HTTPS encryption, and zero vendor detections creates a deceptive appearance of safety, increasing the risk of user deception and credential harvesting. Users should avoid interacting with any pop-ups or prompts originating from download-en-us-live.pages.dev. Disable JavaScript in the browser when visiting unfamiliar domains, especially those hosting tech support lures. Organizations should implement strict DNS filtering policies and block traffic to known malicious subdomains. Report all incidents to PhishDestroy through the official portal to support ongoing threat intelligence enrichment. Exercise caution when downloading files or software from sites using similar naming patterns.