join-satoshivm[.]pages[.]dev

The domain join-satoshivm.pages.dev is currently linked to credential theft attempts and is under active investigation. This domain has been categorized with a specific threat type focused on stealing user credentials, which poses a significant risk to users interacting with it.

According to known intelligence, join-satoshivm.pages.dev resolves to the IP address 172.66.47.146 and is registered through Cloudflare, Inc. Despite appearing on 2 security blocklists, this domain has not been flagged by any of the 95 VirusTotal vendors, indicating it may be relatively new or designed to evade detection. The domain also holds an SSL certificate from Google Trust Services, which may be used to create a false sense of legitimacy.

Currently, the domain remains active and under investigation, with multiple security services such as Enkrypt and ScamSniffer blocking it. It is recommended that users avoid interacting with join-satoshivm.pages.dev, refrain from submitting any credentials, and ensure they have updated security software. Organizations should continue to monitor this domain and related indicators to mitigate potential risks associated with credential theft.