demoboy[.]pages[.]dev

The domain demoboy.pages.dev is classified as a generic phishing infrastructure delivering a crypto-themed marketplace lure under the branding “Web3connectvault - A crypto buy and sell marketplace”. The page content suggests credential harvesting or transactional deception targeting cryptocurrency users, likely designed to simulate a trading or exchange environment. No explicit drainer kit signature is confirmed in the available intelligence, but the thematic positioning aligns with credential theft campaigns involving wallet or account capture workflows.

Technical indicators show the domain resolves to IP 188.114.96.3 and is hosted under Cloudflare, Inc. infrastructure in Canada. The domain was registered on March 23, 2026 and uses Google Trust Services / WE1 SSL certificate issuance. VirusTotal reports 4/95 security vendors flagging the domain as malicious. The domain appears on 1 security blocklist and is actively blocked by PhishDestroy. No Google Safe Browsing status was provided in the dataset. These combined indicators reflect early-stage but active malicious deployment.

At time of analysis, demoboy.pages.dev remains active and publicly accessible. The combination of low but confirmed detection rate (4/95 VT), recent domain creation, and crypto marketplace impersonation increases likelihood of ongoing credential theft attempts. Recommended response actions include immediate blocking at DNS and web filtering layers, monitoring for payload or form submission endpoints, and tracking any domain reuse or subpage expansion. Residual risk remains high due to active hosting and demonstrated security detections, despite partial infrastructure reputation masking via Cloudflare services.