evedex[.]pro

This domain, evedex.pro, operates as a fake authentication portal designed to harvest user credentials through deceptive login interfaces. Analysis indicates the site mimics legitimate single sign-on pages, tricking visitors into entering sensitive account details such as usernames, passwords, and multi-factor authentication codes. The infrastructure is optimized for rapid deployment and evasion, leveraging cloud-based hosting to obscure its malicious intent while maintaining a superficially legitimate appearance. Evidence supporting this assessment includes detection by 4 out of 95 security vendors on VirusTotal, indicating moderate but consistent identification as malicious. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, an uncommon registrar choice that may suggest an attempt to avoid scrutiny. It appears on two security blocklists, including PhishDestroy and OISD, and resolves to the IP address 104.21.30.55, a Cloudflare-associated endpoint commonly exploited for anonymity. The SSL certificate issued by Google Trust Services further masks its true nature, presenting a false sense of security to potential victims. Users who visited evedex.pro should immediately terminate any active sessions and revoke access to any accounts entered on the site. Credentials exposed to this domain must be changed across all platforms where reused, with priority given to email, financial, and administrative accounts. Multi-factor authentication should be enabled using app-based or hardware tokens rather than SMS or email-based methods. Network administrators are advised to block the domain and its resolving IP at the perimeter, and monitor for any residual connections or credential-stuffing attempts originating from internal hosts. The domain's current offline status does not preclude future reactivation, necessitating ongoing vigilance.