connexion[.]pages[.]dev

This domain, connexion.pages.dev, is flagged as a generic phishing threat designed to impersonate authentication portals. Analysis indicates it targets users by presenting a fraudulent login interface titled 'Connexion,' likely harvesting credentials for unauthorized access or follow-on attacks. The domain poses a risk to individuals and organizations by mimicking legitimate login workflows, potentially leading to account compromise or data exfiltration. Infrastructure analysis reveals the domain was registered on November 26, 2023, through Cloudflare, Inc., and resolves to the IP address 172.66.44.167, hosted on AS13335. As of the latest assessment, the domain appears on 1 security blocklist, though VirusTotal reports 0 detections out of 95 engines. The SSL certificate is issued by Google Trust Services (WE1), which may lend a false sense of legitimacy to unsuspecting users. The domain remains active and unflagged by most detection platforms, increasing its potential reach. Users who have visited connexion.pages.dev or entered credentials on this site should immediately revoke any submitted information and change passwords for associated accounts. Monitor for unauthorized access or suspicious activity, particularly in accounts linked to the same email or credentials. Network administrators should block the domain and its resolving IP (172.66.44.167) at the perimeter to prevent further exposure. If corporate devices were used, initiate an endpoint scan to detect potential malware or credential theft tools.