salmon-ekx[.]pages[.]dev

Salmon-ekx.pages.dev is a credential phishing domain that has been taken offline. It was first detected on March 25, 2026, the same day it was created. The domain is flagged by 5 out of 94 vendors on VirusTotal as malicious, highlighting its threat level. It is also listed on 4 public blocklists, including PhishDestroy, MetaMask, ScamSniffer, and SEAL, indicating a broad recognition of its malicious intent.

The domain was registered through Cloudflare, Inc. and hosted on an IP address in Canada managed by CloudFlare, Inc. The SSL certificate was issued by Google Trust Services, which is commonly used for legitimate sites, potentially aiding in the phishing domain's deceptive appearance. The domain's page title, "Solomon," does not directly indicate a specific brand being targeted, suggesting a generic phishing operation.

Despite its offline status, the domain's initial activity posed a significant risk, with a platform risk score of 75 out of 100. This score reflects the potential impact and likelihood of successful credential theft had the domain remained active. The swift detection and subsequent takedown of salmon-ekx.pages.dev demonstrate the effectiveness of early threat identification and response measures in mitigating phishing risks.