devcompose[.]com

Analysis of devcompose.com indicates an active phishing domain targeting user credentials. The domain was registered on May 23, 2026, through DYNADOT LLC, a registrar frequently observed in phishing infrastructure. It currently resolves to the IP address 186.2.175.81, which has been associated with other suspicious domains in recent months. The nameservers ns1.dyna-ns.net and ns2.dyna-ns.net are consistent with the registrar's default configuration, though such configurations are often exploited due to their low barrier to entry for threat actors. The domain remains operational as of July 18, 2026, with no evidence of takedown or mitigation. While the exact content and targeted brand have not been fully analyzed, the classification as 'generic_phishing' suggests a broad credential harvesting scheme rather than a highly customized impersonation of a specific service. Defenders are advised to treat this domain as hostile and implement blocking measures at the DNS or network level. Further investigation is required to determine the full scope of the campaign, including any associated malware distribution or lateral movement within compromised environments. No detection metrics from public scanning platforms are currently available, and the domain's infrastructure does not exhibit overtly malicious patterns beyond its registration and resolution details. Organizations should monitor for connections to 186.2.175.81 and correlate with any internal alerts related to credential theft or unauthorized access attempts.