jesy[.]pages[.]dev

This domain, jesy.pages.dev, is flagged for credential theft. It does not appear to be associated with a specific brand or drainer kit, but its activity is consistent with generic phishing operations designed to harvest sensitive user information such as login credentials.

Infrastructure analysis reveals that the domain has a VirusTotal score of 15/95, indicating that 15 out of 95 security vendors have flagged it as malicious. The domain is registered through Cloudflare, Inc., and resolves to the IP address 188.114.96.3. It was created on July 21, 2024, and is currently listed in Google Safe Browsing as unsafe. Additionally, the domain appears on four security blocklists: PhishDestroy, MetaMask, ScamSniffer, and SEAL. The SSL certificate is issued by Google Trust Services / WE1, which might lend a false sense of security to unsuspecting users.

Despite the domain being currently active, the significant number of security vendors and blocklists flagging it suggests a high level of threat. Immediate response actions should include blocking access to the domain at the network level and educating users about the risks of credential theft. The remaining risk is high, as the domain continues to resolve and may still be used to target users. Further monitoring and potential takedown efforts are recommended to mitigate ongoing threats.