snailbrookwhitelist[.]pages[.]dev

PhishDestroy identifies snailbrookwhitelist.pages.dev as an active SSL-based phishing domain designed to masquerade as a legitimate whitelist entry, thereby tricking users into surrendering credentials or downloading malicious payloads.

This domain was flagged by multiple security vendors—specifically 1 out of 95 engines on VirusTotal—and is currently blocked by ScamSniffer and Enkrypt. It resolves to IP 172.66.44.146 via Cloudflare, Inc., which also issued the domain’s Google Trust Services SSL certificate. Evidence from security blocklists confirms its presence across two separate lists, indicating widespread recognition as a malicious host.

Organizations and users who accessed this domain should immediately inspect network logs for any POST requests to /login or /submit endpoints, as these are typical paths used in credential harvesting. Disconnect affected endpoints from sensitive networks, reset passwords for accounts that may have been exposed, and scan for follow-on malware such as infostealers or Cobalt Strike beacons. Users should also report the domain to their browser blocklist providers and avoid any future TLS sessions unless TLS inspection is performed by a trusted proxy.