presalefarm[.]pages[.]dev

The domain presalefarm.pages.dev has been identified as a source of generic phishing attempts. VirusTotal records show that the host was scanned by 91 AV engines, none of which reported a detection at the time of analysis. The domain is listed on a single external security blocklist and is actively blocked by the PhishDestroy filtering service.

No additional indicators such as Safe Browsing warnings, Open Threat Exchange reports, registrar details, IP address, hosting ASN, SSL certificate metadata, HTTP response codes, or trust‑score assessments are currently available in public feeds. The page title and any content‑specific markers have not been disclosed, leaving the exact lure or credential‑capture method undocumented. This lack of infrastructure visibility creates uncertainty around the scale of the campaign and whether the domain is part of a broader malicious infrastructure.

Defenders should treat the domain as hostile: add it to DNS and proxy deny lists, ensure endpoint URL filtering solutions include it, and monitor network traffic for any outbound connections to the host. Continuous re‑scanning with multi‑engine services is advised to capture any future changes in detection status. Organizations should also review authentication logs for attempted logins originating from this domain and enforce multi‑factor authentication to mitigate potential credential compromise.