site-6953700251-cryptrecovers-eu[.]pages[.]dev

This domain, site-6953700251-cryptrecovers-eu.pages.dev, is an active credential phishing site targeting users under the guise of a service labeled 'cryptrecovers - Premium,' as indicated by the page title. Infrastructure analysis reveals the domain was registered on March 22, 2026, through Cloudflare, Inc., and is currently hosted behind Cloudflare’s network, resolving to the IP address 188.114.97.3 (AS13335, CA). The site employs a Let’s Encrypt SSL certificate (serial number E8) and enforces HSTS, suggesting an attempt to appear legitimate to end users. Technologies detected include Unpkg and HTTP/3, which are consistent with modern phishing kits designed to evade detection or improve performance. Security vendors have flagged this domain, with 11 of 94 engines on VirusTotal identifying it as malicious. It appears on two security blocklists and is actively blocked by at least two anti-phishing tools. The HTTP status code 403 may indicate the site is restricting access to specific regions, user agents, or requiring additional verification to avoid automated analysis. The exact content of the phishing page remains unconfirmed, as no brand target beyond the 'cryptrecovers' label is specified in available data. Defenders should treat this domain as high-risk and prioritize blocking it at the DNS or network level. Further investigation into associated infrastructure, such as nameservers (kinsley.ns.cloudflare.com, marty.ns.cloudflare.com), may reveal additional linked domains or campaigns. Given the domain’s recent registration and active status, monitoring for new subdomains or redirects under the same Cloudflare Pages infrastructure is recommended.