dashboard-beets[.]xyz

This domain, dashboard-beets.xyz, has been confirmed as a credential theft phishing site designed to harvest user login credentials through deceptive login portals. Analysis indicates the site employs no overt brand impersonation but instead presents generic authentication interfaces likely targeting corporate or personal account credentials. No specific drainer kit signatures were detected in initial scans, though the use of Cloudflare and Let’s Encrypt SSL suggests an attempt to evade detection while maintaining a veneer of legitimacy. Infrastructure analysis reveals the domain was registered on March 13, 2026, through Dynadot LLC, a registrar frequently observed in phishing campaigns. It resolves to the IP address 104.21.48.245, a Cloudflare-hosted endpoint leveraging HTTP/3 for performance and obfuscation. At the time of assessment, the domain was flagged by 3 out of 95 security vendors on VirusTotal and appeared on one security blocklist. The page title, dashboard-beets.xyz | 504: Gateway time-out, suggests either a temporary outage or deliberate misconfiguration to evade automated crawlers. No entries were found on Google Safe Browsing at the time of this report. The domain has since been taken offline, likely in response to detection by security systems. However, the elevated risk persists due to the domain’s recent registration and the use of bulletproof infrastructure. Users who may have interacted with the site are advised to rotate credentials immediately, particularly for accounts accessed during the exposure window. Organizations should monitor for anomalous authentication attempts and consider implementing additional verification layers for sensitive systems. The registrar’s response and potential re-emergence of the domain under a new alias remain key risk factors in this campaign.