ytshop[.]pages[.]dev

PhishDestroy identifies an active credential theft campaign originating from the domain ytshop.pages.dev, which impersonates the popular movie streaming brand YTSHOP.

This domain was flagged for generic phishing activities by OpenPhish and remains under investigation by security teams. Analysis reveals no detections on VirusTotal as of the latest scan, with 17 out of 95 vendors marking it malicious. The domain is registered through Cloudflare, Inc., resolves to IP 172.66.44.232, and has been assigned an SSL certificate by Google Trust Services. Additionally, the domain appears on 1 security blocklist, though its risk level is currently classified as under_investigation.

Given the absence of widespread detection despite active abuse and the use of Cloudflare’s infrastructure to obscure origin, this threat poses a significant risk to users expecting legitimate YTSHOP services. The domain’s recent creation and low VT score indicate evasion tactics, likely leveraging fresh hosting and SSL services to bypass initial scrutiny. Credential theft phishing pages often mimic login or payment portals to harvest sensitive data, exposing victims to financial or identity theft.

Security teams are advised to block ytshop.pages.dev at the network perimeter and monitor for related DNS resolutions. Users should verify URLs before entering credentials and avoid clicking suspicious links. Implementing browser-based protections or DNS filtering solutions can mitigate exposure. Further analysis is recommended to identify additional infrastructure tied to this campaign.