gmx-account[.]pages[.]dev

PhishDestroy identifies the active credential phishing campaign hosted at gmx-account.pages.dev, which impersonates GMX email service login portals to deceive users into surrendering account credentials.

This domain poses a high risk as it specifically targets GMX users by presenting a fraudulent step-by-step login guide titled 'How to Login GMX Account? | Step-by-Step Guide.' The threat is facilitated through a Cloudflare-incorporated domain (registered via Cloudflare, Inc.) resolving to IP address 188.114.96.3. As of current assessments, VirusTotal records 0 detections out of 95 security engines, indicating this domain has evaded detection by antivirus and threat intelligence platforms. The domain operates under pages.dev, a legitimate Google Cloud platform, leveraging Google Trust Services SSL certificates to enhance credibility and reduce user suspicion. Despite its technical legitimacy, the page’s primary function is to harvest GMX credentials under the guise of providing login assistance.

This phishing page represents a direct and imminent threat to GMX account holders, particularly those seeking password resets or login troubleshooting. The absence of detection on VirusTotal highlights the sophistication of the campaign, which may spread through unsolicited emails, social media, or search engine ads targeting GMX users. Users are strongly advised to verify login URLs directly through GMX’s official website (gmx.net or gmx.com) and avoid clicking links from third-party domains. If credentials have been entered, users should immediately change their GMX password, enable multi-factor authentication, and scan connected devices for malware. Report the domain to GMX support and block access to gmx-account.pages.dev to prevent further exploitation.