shaw-tracker[.]pages[.]dev

This domain, shaw-tracker.pages.dev, is flagged as a high-risk credential phishing site targeting users of the Shaw telecommunications brand. Analysis indicates the page presents itself as "Shaw EOD Tracker v2.1," a fabricated service designed to harvest login credentials. The domain remains active as of the latest verification, posing an ongoing threat to unsuspecting users. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on May 19, 2026, and resolves to the IP address 188.114.96.3, hosted in Canada under Cloudflare’s network. The SSL certificate is issued by Let’s Encrypt (serial number E8), a common but not inherently malicious provider. Detection metrics show 16 of 95 security vendors on VirusTotal have flagged the domain as malicious, while it appears on one security blocklist, specifically PhishDestroy. The domain’s creation date is notably in the future, suggesting potential data manipulation or a placeholder entry, though this does not diminish its current threat status. The domain remains active and continues to host phishing content. Organizations and users are advised to block the domain and its resolving IP at the network level. Endpoint protection systems should be updated to include this domain in deny lists. Users who may have interacted with the site should reset credentials for any associated accounts, particularly those tied to Shaw services, and monitor for unauthorized activity. Network administrators should review logs for connections to 188.114.96.3 or requests to shaw-tracker.pages.dev to identify potential compromises.