en-us-download-app[.]pages[.]dev

PhishDestroy identifies en-us-download-app.pages.dev as a currently-active domain engaged in a software impersonation phishing campaign.

This domain was flagged by 8 of 95 VirusTotal vendors as of the latest scan and is currently under investigation. The site resolves to IPv4 address 188.114.97.3 and is registered via Cloudflare, Inc. The SSL certificate is issued by Google Trust Services. Current WHOIS data places the domain’s creation date within the last 90 days, and it has not yet appeared on any public blocklists. Trust scores for associated infrastructure remain neutral, pending deeper behavioral analysis.

Despite zero VirusTotal detections at this time, the choice of a Cloudflare Pages subdomain hosting pattern, combined with a Google-trusted certificate, indicates an attempt to mimic legitimacy while distributing potentially malicious application downloads. Given the current status and absence of immediate signature-based detection, this domain poses a credible risk for users searching for legitimate software installations. Users who have interacted with this domain should revoke any granted permissions, scan local devices, and verify application sources through official channels. Organizations are advised to block the domain at DNS and network levels, monitor endpoints for unusual installers, and report any observed anomalies to incident response teams.