explore-en-core-app[.]pages[.]dev

Analysis of explore-en-core-app.pages.dev indicates brand impersonation targeting Bitcoin users. The domain, registered on April 6, 2026, through Cloudflare, Inc., resolves to IP 188.114.96.3 (AS13335, Cloudflare, Inc., CA). The page title, 'Core.app | Your Gateway to Bitcoin-Powered DeFi & Cross-Chain Trading,' directly references Core.app, a known Bitcoin wallet and DeFi platform, suggesting intent to deceive users into believing the site is legitimate. The domain currently returns HTTP status 200 and remains active as of July 12, 2026. Gridinsoft assigns a trust score of 0/100, and the domain appears on one security blocklist, though no detections are recorded by the 94 vendors that scanned it on VirusTotal. The absence of detections does not confirm safety, as malicious domains often evade initial scans. Nameservers (decker.ns.cloudflare.com, oaklyn.ns.cloudflare.com) and SSL certificate (Google Trust Services / WE1) align with Cloudflare infrastructure, which is frequently abused for hosting impersonation sites due to its free tier and privacy features. Defenders should treat this domain as high-risk for Bitcoin-related fraud, particularly credential harvesting or wallet-draining attacks. Blocking or monitoring access to 188.114.96.3 and the domain is recommended pending further analysis. The exact content and functionality of the site remain unconfirmed, as no forensic capture is available.