minecraft-mac-download-code[.]pages[.]dev

PhishDestroy identifies the domain minecraft-mac-download-code.pages.dev as a fake Minecraft installer phishing site currently under active investigation. This domain mimics legitimate Minecraft download pages to deceive users into downloading malicious software under the guise of a macOS installer. Threat actors are leveraging Cloudflare’s Pages service to host these fraudulent pages, exploiting the trust associated with the Minecraft brand to increase credibility and lure victims. This domain was flagged by 0 of 95 VirusTotal vendors as of the latest analysis, indicating a low detection rate despite its malicious intent. The domain is registered through Cloudflare, Inc. and resolves to IP address 188.114.97.3, which is associated with hosting infrastructure used for phishing campaigns. The domain utilizes a Google Trust Services SSL certificate, further enhancing its appearance of legitimacy. As of the investigation’s initiation, the domain has not been widely blacklisted, posing an elevated risk to unsuspecting users seeking legitimate Minecraft downloads. Given the domain's active status and the specific threat it poses, PhishDestroy recommends users exercise extreme caution when downloading software, particularly from unofficial sources. Users should verify the authenticity of download links by cross-referencing with official Minecraft websites or reputable distribution channels. Network administrators and security teams are advised to block the domain minecraft-mac-download-code.pages.dev and the associated IP address 188.114.97.3 at the firewall level to mitigate potential exposure within their environments.