dem-coinsmt-io[.]pages[.]dev

This domain is flagged as a high-risk phishing infrastructure specifically designed for Bitcoin brand impersonation. Analysis indicates the site mimics legitimate cryptocurrency trading portals to harvest credentials and financial data from unsuspecting users seeking Bitcoin-related services.

Infrastructure analysis reveals the domain dem-coinsmt-io.pages.dev was registered on May 06, 2026, through Cloudflare Pages. It currently resolves to IP address 188.114.97.3, hosted in Canada under CloudFlare, Inc. The site displays a page title 'CoinSmart Login 🚀 | Official Portal to Trade Bitcoin & Crypto,' directly impersonating a legitimate cryptocurrency exchange. Detection metrics show 1 of 95 security vendors on VirusTotal have flagged the domain, and it appears on one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of both legitimate and malicious sites leveraging Cloudflare's infrastructure.

Mitigation requires immediate action from network defenders and end users. Organizations should block the domain and its resolving IP (188.114.97.3) at perimeter security controls. Cryptocurrency users should verify domain authenticity before entering credentials, checking for subtle misspellings or unusual subdomains. Given the domain's recent creation date and low detection rate, security teams are advised to monitor for additional related infrastructure, particularly those mimicking cryptocurrency exchanges or wallet services. Users who may have interacted with this domain should rotate credentials immediately and enable multi-factor authentication on all financial accounts.