yala-nft-dapp-test[.]pages[.]dev

The domain yala-nft-dapp-test.pages.dev is currently under investigation for brand impersonation, specifically targeting the Bitcoin brand. The domain appears to be a test or development environment, but it could be part of a broader campaign to deceive users into believing they are interacting with a legitimate Bitcoin service. The threat type is classified as brand impersonation, and no specific drainer kit has been identified.

Infrastructure analysis reveals that yala-nft-dapp-test.pages.dev resolves to the IP address 188.114.96.3, which is located in the United States and is associated with AS13335 Cloudflare, Inc. The domain was created on July 10, 2025, and its SSL certificate is issued by Google Trust Services / WE1. The domain has been flagged by one security blocklist and is currently blocked by PhishDestroy. However, VirusTotal has not detected any malicious activity, with a score of 0/95.

The domain is currently active and requires further investigation to determine the extent of its threat. Organizations and users are advised to exercise caution and avoid interacting with this domain until its legitimacy is confirmed. The risk level remains under investigation, and monitoring should be continued to assess any potential changes in the domain's behavior or detection status.