cvvbkx[.]pages[.]dev

cvvbkx.pages.dev was registered on 21 February 2026 through Cloudflare, Inc. and resolves to the Cloudflare‑owned address 188.114.97.3 located in the United States under ASN 13335. No TLS certificate is presented, so the site is served over plain HTTP. The page title returned by the server is “Connect wallet | Rarible”, while the domain is listed as impersonating the WalletConnect brand and is categorized as a crypto‑scam. PhishDestroy has already taken the site offline and placed it on at least one public security blocklist.

VirusTotal analysis shows that four of ninety‑three scanning engines flagged the domain as malicious, providing additional corroboration of its illicit intent. The combination of brand impersonation, a misleading page title referencing a well‑known NFT marketplace, and the lack of encryption are consistent with credential‑harvesting or wallet‑draining campaigns targeting cryptocurrency users. Current intelligence does not disclose the exact phishing kit or any payload observed on the site, and no Safe Browsing or OTX entries are referenced.

Defenders should continue to block the IP address 188.114.97.3, add the fully qualified domain to DNS sinkhole lists, and monitor for any re‑registration attempts under the same label. Users of WalletConnect and Rarible services should be warned that unsolicited connection prompts originating from this domain are fraudulent, and organizations should update their user‑education material to reference this specific impersonation attempt. Ongoing surveillance of Cloudflare‑hosted domains with similar naming patterns is recommended to detect future replicas.