devverewards[.]xyz

PhishDestroy identifies an active generic phishing campaign targeting users through the domain devverewards.xyz. This domain masquerades as a rewards program to harvest sensitive credentials and financial information via deceptive web forms. The campaign is classified as elevated risk due to its active status and use of social engineering tactics designed to exploit trust in brand impersonation.

This domain was flagged by 3 out of 95 security vendors on VirusTotal, indicating limited but growing detection. The domain resolves to IP address 104.21.18.195 and was registered on August 13, 2025, through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain holds a valid SSL certificate issued by Google Trust Services, which may increase user trust and reduce suspicion during initial interaction. Despite the SSL certificate, the domain’s recent creation date and low detection rate on VirusTotal suggest it is part of a newly launched campaign likely still evading broader blocklists.

Users should avoid interacting with any links or content from devverewards.xyz, as it poses a high risk of credential theft and financial fraud. If credentials were entered, immediately change passwords on all associated accounts and enable multi-factor authentication. Report the domain to your email provider or security team and consider blocking the IP 104.21.18.195 at the network level. Organizations should update threat intelligence feeds and firewall rules to block this domain and IP to prevent further exposure. Monitor for any unusual account activity following potential exposure.