io-eng-download[.]pages[.]dev

Analysis of the domain io-eng-download.pages.dev indicates active malicious infrastructure targeting users with a generic phishing campaign. The domain was registered on March 27 2026 through Cloudflare, Inc., and is hosted on Cloudflare’s network, resolving to the IPv4 address 172.66.47.89. Both authoritative name servers—anastasia.ns.cloudflare.com and devin.ns.cloudflare.com—are owned by Cloudflare, confirming that the attacker is leveraging the provider’s DNS and CDN services to obscure origin and increase resilience. VirusTotal scans show that six of ninety‑one security vendors have flagged the domain as malicious, providing an early indication of suspicious behavior despite a relatively low detection ratio.

The domain appears on a single external blocklist and is actively blocked by the PhishDestroy feed, demonstrating that at least one community‑maintained source has identified it as a phishing vector. No public page title, SSL certificate details, or HTTP response codes have been released, leaving the exact content and delivery mechanisms of the phishing page unverified. Consequently, defenders lack visibility into the specific brand or credential‑capture tactics employed.

Given the limited public intelligence, the primary recommendation is to enforce proactive network controls: add io-eng-download.pages.dev and its resolved IP address 172.66.47.89 to DNS deny lists, configure web‑filtering solutions to block HTTP(S) requests to the domain, and monitor outbound traffic for connections to Cloudflare edge nodes that may be leveraged for malicious hosting. Security operations teams should also query threat‑intel platforms for any emerging indicators tied to the domain, such as URL hashes or payload samples, and update detection signatures accordingly. Continuous observation of Cloudflare‑associated domains and rapid ingestion of any new blocklist entries will help mitigate the elevated risk posed by this active phishing infrastructure.