io-exchange-coinstor[.]pages[.]dev

This domain, io-exchange-coinstor.pages.dev, operates as a high-risk brand impersonation threat targeting cryptocurrency users. Analysis indicates the site mimics a legitimate Bitcoin exchange platform, presenting itself as 'Coinstore Exchange - Cryptocurrency Exchange for Bitcoin,' with the explicit intent to harvest user credentials and private wallet keys. The fraudulent infrastructure employs social engineering tactics, including replica login portals and deposit prompts, to deceive victims into disclosing sensitive authentication details. Such activity aligns with observed patterns in cryptocurrency phishing campaigns, where threat actors exploit brand recognition to facilitate unauthorized asset transfers. Infrastructure analysis reveals multiple technical indicators supporting the malicious classification. The domain was registered on November 05, 2025, through Cloudflare, Inc., and currently resolves to the IP address 188.114.96.3, located in Canada. Detection metrics further substantiate the threat: the domain appears on three distinct security blocklists and is flagged by 2 out of 95 security vendors on VirusTotal. Despite these warnings, the domain remains active, continuing to host its deceptive content without remediation. Users who have interacted with io-exchange-coinstor.pages.dev should immediately revoke any credentials entered on the site and monitor associated cryptocurrency wallets for unauthorized transactions. It is recommended to conduct a full security audit of devices used to access the domain, including malware scans and network traffic analysis for potential secondary infections. Affected parties should report the incident to relevant financial and cybersecurity authorities, providing the domain, IP address, and any transaction hashes as evidence. Proactive measures, such as enabling multi-factor authentication and verifying domain legitimacy through official channels, are advised to mitigate future exposure.