ws-80h[.]pages[.]dev

The domain ws-80h.pages.dev was a phishing site engaged in brand impersonation, specifically targeting Microsoft users. It presented itself as legitimate Microsoft customer support to deceive victims into entering credentials or sensitive information. No crypto drainer kit was associated with this campaign. The site is currently taken offline, but its prior activity classified it as an elevated-risk phishing threat.

Technical analysis of ws-80h.pages.dev revealed 3 of 95 VirusTotal security vendors flagged the domain, including G-Data, Sophos, and Trustwave. The domain was registered through Cloudflare, Inc. on July 17, 2024, and resolved to the IP address 188.114.97.3, hosted by Cloudflare in the US. It appeared on one security blocklist (PhishDestroy) and used an SSL certificate issued by Google Trust Services (WE1). The observed page title was 'MicrosoftCustomer Support,' and the site employed technologies such as HSTS, Cloudflare, and HTTP/3. At the time of assessment, the domain returned an HTTP 403 status, indicating it was no longer accessible.

Victims of ws-80h.pages.dev should immediately change any passwords entered on the site, particularly for Microsoft accounts, and enable two-factor authentication (2FA) to prevent unauthorized access. Monitor accounts for suspicious activity, such as unauthorized logins or transactions. Report the phishing domain to Microsoft via their official reporting channels and to platforms like Google Safe Browsing or PhishTank to aid in broader mitigation efforts. If financial or personal data was compromised, consider contacting relevant institutions to secure accounts.