tobiblockwebsiteworking[.]pages[.]dev

Analysis of tobiblockwebsiteworking.pages.dev indicates an active phishing infrastructure targeting cryptocurrency users. The domain, created on May 01, 2026, resolves to IP 188.114.96.3, which is geolocated to Canada and is hosted behind Cloudflare's network. The site serves over HTTPS with a certificate issued by Google Trust Services and enforces HSTS, while the front‑end is built on React and delivered via HTTP/3. The page title "Easily Manage your Coins and NFTs in one place | BLOCKCHAINS MAINNET" suggests an attempt to impersonate a legitimate blockchain service, aligning with the classified scam type of a fake exchange. The domain has been flagged by PhishDestroy and appears on a security blocklist; Gridinsoft assigns a trust score of 0/100, and VirusTotal reports three detections out of ninety‑one scanners. Despite these indicators, the content of the site has not been publicly dissected, so the exact credential‑harvesting mechanisms remain unknown. Defenders should immediately block traffic to the domain and its resolved IP at perimeter devices, add the domain to internal threat intelligence feeds, and monitor for any outbound connections to the IP address. Continuous DNS logging is advised to detect any sub‑domain generation or fast‑flux behavior. Updating web‑filter signatures to include the domain and associated SSL fingerprint will help prevent user exposure while broader phishing campaigns are investigated.