click-box-all[.]pages[.]dev

PhishDestroy identifies click-box-all.pages.dev as a credential theft dropper domain actively posing as a legitimate file-sharing or download portal. This deception is designed to trick users into entering login credentials or downloading malicious files while masquerading as a harmless service. The domain leverages Cloudflare’s infrastructure and operates with a valid Let’s Encrypt SSL certificate to appear trustworthy, but its infrastructure reveals inconsistencies that undermine legitimacy. This domain was flagged due to its active placement in phishing campaigns and lack of legitimate use cases. VirusTotal currently shows 2/95 detections, indicating it remains undetected by most antivirus engines—though this is not unusual for freshly observed threats. It is registered through Cloudflare, Inc., resolving to IP address 188.114.97.3, and despite its recent activity, it has not yet been widely blocked by threat intelligence platforms. The domain’s age and infrastructure point to a short operational lifespan typical of malicious domains deployed for rapid credential harvesting or malware distribution. If you have visited click-box-all.pages.dev, avoid entering any login credentials or downloading files. Disconnect from the internet if possible and run a full antivirus scan on your device. Report the domain to your IT security team or use tools like Google Safe Browsing and PhishDestroy’s own threat submission portal to help block it. Monitor your accounts for suspicious activity and consider enabling multi-factor authentication on critical services to mitigate potential credential theft.