# cl-academy-hibiki-win.pages.dev — SUSPICIOUS

> cl-academy-hibiki-win.pages.dev poses as a crypto academy luring users to fake investment pages. Resolves to 172.66.44.166 with 0/95 VirusTotal detections.

## Summary
PhishDestroy identifies cl-academy-hibiki-win.pages.dev as a crypto-scamming infrastructure node currently active in the wild. This Cloudflare Pages domain is weaponized to mimic legitimate crypto academies, specifically targeting users with deceptive investment tutorials that ultimately steal deposited funds. The site is classified under generic_phishing with under_investigation status, indicating active red-teaming and ongoing takedown efforts.

This domain was flagged by 0 of 95 VirusTotal vendors at the time of analysis, resolving to IP address 172.66.44.166 and registered through Cloudflare, Inc. using a Let’s Encrypt SSL certificate. The infrastructure is hosted on Cloudflare’s edge network, which complicates direct IP-based blocking and enhances evasion capabilities against traditional defenses. The domain’s age and reputation remain unassessed due to its recent emergence, but the absence of detections suggests it is either newly deployed or carefully engineered to avoid signature-based detection.

Current status of cl-academy-hibiki-win.pages.dev remains active with risk level under_investigation. Users are advised to avoid accessing the domain entirely and to block the associated IP 172.66.44.166 at the network perimeter. Security teams should integrate this domain and IP into blocklists, monitor for related campaign artifacts, and inspect DNS logs for queries resolving to 172.66.44.166. Given the domain’s use of Cloudflare Pages and Let’s Encrypt, traditional domain blocking may be insufficient; consider DNS sinkholing or RPZ policies for comprehensive coverage. Immediate user awareness campaigns are recommended to prevent engagement with this crypto-scamming front.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 172.66.44.166

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/74578c9a-f1bc-4891-ae70-bdf687b7bb5b
- PhishDestroy: https://phishdestroy.io/domain/cl-academy-hibiki-win.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/cl-academy-hibiki-win.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/cl-academy-hibiki-win.pages.dev/
Last updated: 2026-03-23