beyond-appraisal[.]pages[.]dev

PhishDestroy identifies active credential harvesting operations linked to the domain beyond-appraisal.pages.dev (seed: f31eb4). This campaign masquerades as a legitimate appraisal service to deceive users into submitting sensitive login credentials. The infrastructure remains active and undetected by most security vendors at the time of initial analysis.

This domain was flagged by 0 of 95 VirusTotal vendors as of the investigation’s initiation, indicating a low detection rate despite active malicious usage. The domain resolves to IP address 172.66.47.42, with registration facilitated through Cloudflare, Inc. The SSL certificate, issued by Let’s Encrypt, supports encrypted communication between victims and the malicious server. At the time of registration, this domain exhibited no presence on any known blocklists and maintained neutral trust scores across threat intelligence platforms.

The current status of beyond-appraisal.pages.dev is active and under active monitoring by PhishDestroy. The lack of detections on VirusTotal suggests this campaign may be newly deployed or leveraging benign infrastructure to evade detection. Immediate action is recommended: blacklist the domain and associated IP (172.66.47.42) in perimeter defenses, distribute Indicators of Compromise (IOCs) via threat-sharing platforms, and notify users via security awareness channels to avoid interactions. Additionally, inspect HTTP/S logs for POST requests targeting this domain to identify potential compromise indicators.