web-connexion[.]pages[.]dev

This domain, web-connexion.pages.dev, is identified as a credential harvesting phishing site targeting users through deceptive login interfaces. The site mimics legitimate services to trick visitors into submitting sensitive information such as usernames, passwords, and potentially multi-factor authentication codes. Credential harvesting remains a prevalent attack vector, enabling unauthorized access to personal accounts, financial data, and corporate systems. The simplicity of the page title 'Home' suggests an attempt to appear generic and avoid immediate suspicion while serving malicious content. Analysis indicates the domain was registered on July 19, 2023, through Cloudflare, Inc., and is hosted on infrastructure associated with AS13335 (Cloudflare, Inc.) in the United States. The IP address 172.66.44.225 resolves to this domain, and the SSL certificate is issued by Google Trust Services (WE1), a common practice among phishing sites to appear legitimate. Despite its recent creation, the domain has been flagged by 1 out of 95 security vendors on VirusTotal and appears on one security blocklist, confirming its malicious nature. The low detection rate may indicate the use of evasion techniques or a newly deployed campaign. Users who have visited web-connexion.pages.dev or entered credentials on the site should take immediate action. First, revoke any sessions or logins associated with the credentials submitted, particularly if the same password is used across multiple platforms. Enable multi-factor authentication on all critical accounts to mitigate unauthorized access. Monitor financial and communication accounts for suspicious activity, such as unauthorized transactions or messages sent from your accounts. If corporate credentials were exposed, notify your organization’s security team to initiate incident response protocols. Finally, clear browser cache and cookies to remove any residual tracking or session data associated with the phishing domain.