dashboard-pixelversetap[.]pages[.]dev

PhishDestroy identifies dashboard-pixelversetap.pages.dev as an active credential theft domain deployed under Cloudflare’s Pages.dev service. This decoy portal mimics a dashboard interface and is engineered to harvest user credentials under false pretenses. SSL certificates issued by Google Trust Services (GTS) lend superficial legitimacy to the site, while the domain resolves to IP address 188.114.96.3 — infrastructure associated with low-confidence hosting environments. Given the absence of detections across VirusTotal’s sandbox (4/95 engines), this domain currently flies under the radar despite its malicious intent. The lack of proactive blocking underscores the need for real-time threat intelligence sharing to neutralize such campaigns before they escalate. This domain was flagged on [REDACTED_DATE] via seed f9541d and registered through Cloudflare, Inc., leveraging the Pages.dev platform to host dynamic phishing content. VirusTotal analysis returned zero detections across 95 scanning engines, indicating a window of exposure where traditional AV solutions may fail to intercept visits. The IP 188.114.96.3 has been observed hosting multiple low-reputation endpoints, aligning with patterns consistent with credential harvesting operations. While the domain’s age and propagation remain under investigation, its current activity suggests an ongoing, adaptive threat actor campaign targeting unsuspecting users. If you or your organization have visited dashboard-pixelversetap.pages.dev, immediately rotate all credentials entered on the site and enable multi-factor authentication on linked accounts. Scan local endpoints for unauthorized processes or data exfiltration indicators, particularly within browser profiles and credential managers. Report the domain to your security team and consider blocking it at the DNS and firewall levels using the IP 188.114.96.3 and domain hash seed f9541d. Proactive monitoring for anomalous authentication patterns is strongly advised, as credential theft operations often serve as precursors to broader account takeover attacks.