penvex-darvin-biz-marpex-hilnox-sp15ct12[.]pages[.]dev

PhishDestroy identifies penvex-darvin-biz-marpex-hilnox-sp15ct12.pages.dev as an active credential theft domain posing as a legitimate service to harvest user login credentials. This Pages.dev subdomain leverages Cloudflare’s infrastructure to host a spoofed login portal, likely targeting unsuspecting victims with fake authentication prompts to capture sensitive data. The domain’s use of a Google Trust Services SSL certificate adds a veneer of legitimacy, misleading users into trusting the malicious site. Based on current telemetry, the threat actor behind this campaign appears to be conducting reconnaissance for broader credential harvesting operations, potentially linked to fraudulent activities targeting corporate or personal accounts. This domain was flagged under seed dae629 for high-risk behavior consistent with identity theft campaigns. This domain exhibits multiple red flags indicative of credential theft infrastructure. According to VirusTotal analysis, it remains undetected by 5 out of 95 security engines as of the latest scan, highlighting the evasive nature of the threat. The domain is registered through Cloudflare, Inc., a common choice among threat actors for anonymizing hosting infrastructure, and resolves to IP address 188.114.97.3, a known hosting provider frequently abused for malicious activities. While the exact creation date is not publicly disclosed, the domain’s association with a Pages.dev subdomain suggests recent deployment, likely within the last 30 days. The absence of detections, combined with its infrastructure choices, underscores the urgent need for proactive monitoring and blocking by security teams and end users alike. Users who may have inadvertently visited this domain should immediately audit their account credentials for unauthorized access or suspicious activity. If you entered any login details on this site, change passwords immediately and enable multi-factor authentication (MFA) where available. Report the incident to your IT security team or email provider if corporate credentials were used, as this domain may be part of a larger credential stuffing campaign. Ensure your device is scanned for malware, as threat actors often deploy keyloggers or browser hijackers to maintain persistence. To prevent future exposure, avoid clicking on unsolicited links and verify the authenticity of websites through official channels. This domain remains active as of the latest assessment, and users are strongly advised to block it at the network level and update their threat intelligence feeds accordingly.