kisok-cf-pages[.]pages[.]dev

kisok-cf-pages.pages.dev was registered on March 25, 2026 through Cloudflare, Inc. The domain resolves to the Cloudflare IP address 188.114.97.3, which is geolocated to Canada. The authoritative name servers are lola.ns.cloudflare.com and miguel.ns.cloudflare.com. TLS is terminated with a Google Trust Services certificate (WE1) and HTTP/3 is enabled, indicating a modern web stack. The site returns HTTP 200 and presents a page titled “Bridge BTC to Ethereum, Arbitrum, Base, Hyperliquid | Garden”. The content explicitly references Ethereum and offers a bridge service, which aligns with the observed brand‑impersonation behavior. Technical analysis shows the presence of WebAssembly modules, strict transport security (HSTS), Google Tag Manager, and Cloudflare’s edge services, all of which are typical of fast‑flux phishing pages that aim to appear legitimate. Threat intel flags the domain as a brand‑impersonation campaign targeting Ethereum users. It is currently listed on one security blocklist and has been blocked by PhishDestroy. The Gridinsoft trust score of 0/100 and a zero‑detection result on VirusTotal (0/95) suggest that the payload is not yet identified by automated scanners, but the combination of brand misuse and active hosting warrants immediate mitigation. Uncertainty remains regarding the exact payload delivered after a user interacts with the bridge interface, as no malware detections have been reported. Analysts should monitor DNS queries for the domain, enforce URL filtering, and consider sinkholing the IP address to disrupt traffic. Continuous re‑scanning with multi‑engine services is recommended to capture any future payload evolution.