wconnect[.]pages[.]dev

The domain wconnect.pages.dev is currently active and has been classified with an elevated risk rating due to its use as a credential‑harvesting portal. Infrastructure analysis shows the domain resolves to the IP address 188.114.96.3, which is hosted behind Cloudflare’s network. Both authoritative nameservers, jakub.ns.cloudflare.com and veda.ns.cloudflare.com, are owned by Cloudflare, Inc., indicating that the registration and DNS services are provided through the same provider. VirusTotal has recorded ten positive detections out of ninety‑one submitted security scanners, confirming that a minority of AV engines have identified malicious behavior associated with the domain.

Independent blocklist aggregators PhishDestroy and ScamSniffer have already added the domain to their deny lists, and the domain appears on two additional public blocklists, further reinforcing its malicious reputation. No public SSL certificate details, HTTP status codes, or page‑title information have been disclosed, leaving the exact content and delivery mechanisms of the site unverified. Consequently, the precise phishing lure, targeted brands, or credential‑capture tactics remain unknown.

Nonetheless, the combination of active hosting, multiple detections, and blocklist listings warrants immediate mitigation. Defenders should block any outbound or inbound traffic to wconnect.pages.dev at the DNS and network layers, add the domain to local threat‑intel feeds, and monitor for any related C2 communication to the associated IP address. Continuous re‑evaluation is advised, as further analysis may reveal additional indicators such as TLS fingerprints or specific login pages.