foxcon[.]nano-dev[.]shop

This domain, foxcon.nano-dev.shop, was designed to steal login credentials for Chevron Corporation. It posed as a legitimate Chevron login page, tricking employees or partners into entering their usernames and passwords. This is a classic credential theft attack, not just generic phishing. The risk is elevated because anyone who entered their credentials could have their account compromised, leading to potential data breaches or financial loss.

Our investigation shows that foxcon.nano-dev.shop resolves to IP address 198.12.80.250 and had no SSL certificate, a red flag. VirusTotal flagged it with 3 out of 95 security vendors detecting malicious activity, and it appears on one security blocklist. The domain was taken offline after being reported, but its creation details suggest it was set up specifically for this campaign. The page title 'Chevron Corp - Login' confirms the brand impersonation.

If you visited this site and entered any credentials, change your Chevron password immediately and enable two-factor authentication. Also, contact your IT security team to check for any unusual activity. For safety, avoid clicking links in unsolicited emails and always verify URLs before logging in. PhishDestroy recommends reporting such domains to blocklists to protect others.