jdaesthetic-hestia[.]pages[.]dev

PhishDestroy identifies jdaesthetic-hestia.pages.dev as an active fake-login phishing domain currently under investigation for harvesting user credentials. The site impersonates a legitimate aesthetic service and is designed to trick visitors into submitting login details on a counterfeit landing page. Early behavioral analysis indicates the domain is engaged in credential theft campaigns, with infrastructure optimized to evade static detection. Users who access the page may unknowingly expose usernames and passwords to attackers controlling the site. As the threat evolves, immediate caution is advised to prevent account compromise.

This domain was flagged by PhishDestroy with a risk level marked as under_investigation. VirusTotal shows 0 out of 95 detection engines flagged the site as malicious, indicating it has not yet been widely recognized by automated scanners. The domain is registered through Cloudflare, Inc., resolving to IP address 172.66.44.164 on a Let's Encrypt SSL certificate, which adds a false sense of legitimacy. While no confirmed blocklist entries are currently documented, the low detection rate suggests active avoidance of signature-based detection. Trust scores remain neutral due to the domain's recent deployment and the use of reputable hosting and certificate services to mask malicious intent.

To mitigate exposure to this fake-login phishing domain, avoid entering any credentials or personal information on jdaesthetic-hestia.pages.dev. Verify the legitimacy of web pages by checking the full URL, ensuring it matches the official domain, and confirming the presence of HTTPS with a valid certificate issued for the correct entity. Use password managers with built-in phishing detection, or manually type known-safe URLs instead of clicking links in emails or messages. Report suspicious activity to your organization’s security team or through public phishing reporting platforms to help disrupt the campaign and protect others.