darkex-login-en-us[.]pages[.]dev

PhishDestroy identifies darkex-login-en-us.pages.dev as an active credential phishing domain designed to steal login credentials from unsuspecting users. This site mimics legitimate login interfaces to trick victims into entering their usernames and passwords, which are then harvested by attackers for fraudulent access or sold on dark web markets. The page leverages Cloudflare Pages to host fake login forms while concealing its true origin behind Cloudflare’s infrastructure, making detection harder for casual users. This domain was flagged by PhishDestroy after 7 out of 95 VirusTotal security vendors detected malicious content during automated scans. Registered through Cloudflare, Inc., the page resolves to IP 172.66.46.243 and uses a Google Trust Services SSL certificate to appear legitimate. While these technical details may seem reassuring, they are intentionally abused to deceive users who check for HTTPS or trust Cloudflare-hosted content. The domain’s recent creation and rapid deployment suggest an opportunistic attack targeting users seeking quick access to services. If you visited darkex-login-en-us.pages.dev, immediately change any passwords you entered and enable multi-factor authentication on all related accounts. Scan your device with updated antivirus software to check for malware or keyloggers that may have been installed. Report the domain to your IT department or security provider, and avoid interacting with similar Cloudflare-hosted pages unless you can verify their legitimacy through official channels. Staying vigilant about unexpected login prompts can prevent credential theft and account takeover.