io-us-download[.]pages[.]dev

Analysis of io-us-download.pages.dev, observed on July 29 2026, indicates that the domain is being used for a generic phishing campaign. The domain is registered through Cloudflare, Inc. and uses Cloudflare's authoritative name servers anastasia.ns.cloudflare.com and devin.ns.cloudflare.com. DNS resolution returns the address 172.66.44.73, an IP range associated with Cloudflare's global edge network. The domain was submitted to VirusTotal where 91 anti‑malware vendors examined the payload; none reported a detection at the time of scanning.

Absence of detections does not guarantee that the content is benign, and the domain remains under investigation. Independent threat‑intel sources have added the domain to a single security blocklist, and the commercial phishing‑mitigation service PhishDestroy has marked it as blocked. No additional intelligence such as SSL certificate details, HTTP response codes, page titles, or brand targeting is currently available.

Consequently, the confidence in the domain’s malicious intent is based primarily on its inclusion in a blocklist and its classification by PhishDestroy, corroborated by the Cloudflare‑hosted infrastructure common to many abuse campaigns. Defenders should continue to block the domain at network perimeter and DNS layers, monitor outbound connections to 172.66.44.73, and update detection rules to flag any traffic to the Fully Qualified Domain Name. Ongoing collection of HTTP and payload samples is recommended to confirm the phishing technique and to enrich future indicators of compromise.