koi-finance[.]pages[.]dev

Analysis of koi-finance.pages.dev indicates a confirmed credential‑phishing operation. The domain was registered on February 21, 2026 through Cloudflare, Inc., and resolves to the Cloudflare‑owned address 172.66.44.61 (AS13335, United States). The site presents a Cloudflare‑issued SSL certificate signed by Google Trust Services (WE1), but HTTP requests return a 403 status, suggesting the content has been taken offline at the time of analysis. Reputation metrics are extremely low: Gridinsoft assigns a trust score of 0 / 100, and Scamadviser rates the domain 11 / 100.

The domain appears on five independent security blocklists and is actively blocked by PhishDestroy, MetaMask, ScamSniffer, SEAL, and Enkrypt. VirusTotal scans show five of ninety‑three antivirus engines flag the domain as malicious, reinforcing the phishing classification. The page title returned from the server is "Suspected phishing site | Cloudflare," confirming that the host is being used for phishing rather than legitimate content.

While the exact phishing landing page cannot be inspected because the site is offline, the combination of a recent registration, Cloudflare hosting, low trust scores, multiple blocklist listings, and vendor detections provides strong evidence of credential‑phishing intent. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑activation, and include the IP address 172.66.44.61 in threat‑intel feeds. Further investigation may focus on any associated subdomains or similar domains registered through the same Cloudflare account, as attackers often reuse infrastructure for subsequent campaigns.