en-learn-download[.]pages[.]dev

PhishDestroy identifies en-learn-download.pages.dev as an active generic phishing domain currently under investigation for malicious file hosting activities. The domain is not associated with any legitimate educational or software distribution entity and exhibits suspicious behavior consistent with credential harvesting or malware distribution campaigns. Users are advised to exercise extreme caution when accessing this domain or any linked content.

This domain was flagged by 0 of 95 VirusTotal vendors at the time of analysis, indicating a low detection rate despite its malicious intent. It is registered through Cloudflare, Inc., resolves to IP address 188.114.97.3, and utilizes a Google Trust Services SSL certificate, which may be leveraged to falsely imply legitimacy. The domain operates under Cloudflare’s Pages.dev platform, a legitimate service often abused for phishing due to its free hosting capabilities and masking potential.

The current status of en-learn-download.pages.dev remains active, with no immediate takedown observed. Given the lack of detections by security vendors and the domain’s use of a trusted SSL certificate, users should treat this domain as high-risk. Concrete recommendations include immediately blocking the domain at the network or DNS level, refraining from downloading any files or entering credentials, and reporting the domain to relevant cybersecurity authorities such as PhishDestroy or local CERT teams. Additionally, users who have interacted with this domain should run a full malware scan and change any potentially exposed passwords from a separate, secure device.