dewysav.com की फ़िशिंग और सुरक्षा जाँच

This domain, dewysav.com, is actively engaged in brand impersonation targeting Charlotte Tilbury customers through a fraudulent $750 beauty gift scam. The page title explicitly mimics legitimate promotional offers, luring victims into entering personal and financial details under the guise of an exclusive reward. Analysis indicates this is a credential theft operation, likely designed to harvest login credentials, payment information, or other sensitive data for subsequent exploitation or resale on underground markets.

Infrastructure analysis reveals the domain was registered on April 20, 2026, through COSMOTOWN, INC., and currently resolves to 185.66.140.182, an IP address hosted in the Netherlands under AS200514 (KnownSRV Ltd.). Detection remains limited, with only 1 of 95 security vendors on VirusTotal flagging the domain as malicious. Additionally, the domain appears on a single security blocklist, suggesting it has evaded broader detection thus far. The SSL certificate is issued by Let's Encrypt (R12), providing a superficial layer of legitimacy to deceive users.

Users who have visited dewysav.com or interacted with its content should immediately cease all engagement and take remedial actions. Reset passwords for any accounts entered on the site, particularly those linked to financial services or email. Monitor bank statements and credit reports for unauthorized transactions, as stolen credentials may be used for fraudulent purchases or identity theft. If payment details were submitted, contact the relevant financial institution to report potential exposure and request card replacement. Additionally, scan the device used to access the domain for malware, as phishing pages may deploy secondary payloads.