dexham.pages.dev Targeting Users with Credential Harvesting Scam

dexham.pages.dev presents an elevated risk due to its involvement in credential harvesting phishing. This specific threat aims to deceive victims into divulging login credentials, posing a significant security danger to users and organizations alike.

According to VirusTotal, 16 out of 95 security vendors have identified this domain as malicious. It was registered through Cloudflare, Inc., and resolves to the IP address 188.114.97.3. The domain is currently active and appears on two separate security blocklists, including ScamSniffer and PhishingDB. Its SSL certificate is issued by Google Trust Services, which may lend it an appearance of legitimacy to unwary users. The domain’s presence on multiple blocklists confirms its malicious intent and elevated threat level.

To mitigate risks associated with credential harvesting from dexham.pages.dev, organizations should implement domain and IP blocking through firewalls and endpoint security solutions. User education on recognizing phishing attempts is critical, emphasizing scrutiny of unexpected credential requests even on HTTPS sites. Continuous monitoring of traffic for connections to flagged IPs and domains like dexham.pages.dev, alongside updating threat intelligence feeds, will enhance defensive posture against this ongoing threat.