web--ndex-login[.]pages[.]dev

The domain web--ndex-login.pages.dev has been identified as a credential phishing site designed to impersonate WebIndex, a legitimate web analytics and indexing service. This infrastructure targets users by presenting fraudulent login interfaces to harvest account credentials. As of the latest assessment, the domain has been taken offline, though prior activity remains a documented threat. Analysis of the domain reveals it was registered on October 27, 2025, through Cloudflare, Inc., a registrar commonly utilized for both legitimate and malicious hosting. The domain resolves to the IP address 188.114.96.3, which is geolocated in the United States and associated with AS13335, a known autonomous system operated by the same registrar. Detection metrics indicate that 10 of 95 security vendors on VirusTotal flagged the domain as malicious, while Google Safe Browsing explicitly classified it as phishing. Additionally, the domain appears on one security blocklist, and its SSL certificate, issued by Google Trust Services (WE1), provides minimal assurance due to the lack of extended validation. Current status confirms the domain has been deactivated, though residual risk persists for users who may have interacted with it prior to takedown. Organizations and individuals are advised to monitor for unauthorized access to accounts linked to WebIndex or similar services. Network administrators should update blocklists to include the domain and its resolved IP address. Users who entered credentials on this site should immediately reset passwords and enable multi-factor authentication where available. Proactive threat hunting for related indicators of compromise, such as the IP 188.114.96.3, is recommended to identify potential lateral movement or follow-on attacks.