download---app--live[.]pages[.]dev

This domain, download---app--live.pages.dev, is actively engaged in credential harvesting phishing operations targeting users seeking software downloads. Analysis indicates the site mimics legitimate application distribution portals, employing social engineering tactics to trick visitors into entering sensitive login details or installing malicious payloads. The infrastructure is designed to appear authentic, often leveraging cloned interfaces of popular software vendors to lower user suspicion and increase the likelihood of successful compromise. Infrastructure analysis reveals the domain was registered on May 27, 2026, through Cloudflare Pages, a platform frequently abused for hosting phishing content due to its free tier and ease of deployment. As of the latest scan, 8 out of 95 security vendors on VirusTotal have flagged this domain as malicious, indicating a consensus among detection systems regarding its harmful nature. The domain appears on one security blocklist, though its continued activity suggests evasion techniques may be in use to delay broader detection. The unique seed f2a6e5 has been assigned to track this specific threat instance. Users who have visited download---app--live.pages.dev should immediately revoke any credentials entered on the site and monitor associated accounts for unauthorized activity. If any files were downloaded from this domain, disconnect the device from the network and perform a full system scan using updated security tools. Browser caches and saved passwords should be cleared to eliminate residual session data. Organizations are advised to block the domain at the network level and alert employees to the ongoing threat. Given the domain's active status, continued vigilance is recommended, particularly for users who may have interacted with the site prior to its detection.