ad-5ws[.]pages[.]dev

This domain, ad-5ws.pages.dev, operates as a fraudulent investment opportunity phishing site, specifically targeting users with a fabricated "IO Unlocking Phase" claiming access to $13.5 million USD. The page title and content are designed to mimic legitimate cryptocurrency or high-value asset unlocking events, a common tactic to lure victims into entering sensitive credentials or transferring funds under false pretenses. Analysis indicates the site employs psychological manipulation by presenting a large monetary figure to create urgency and exploit financial greed, a hallmark of advanced phishing operations. Infrastructure analysis reveals multiple high-risk indicators. The domain was registered on July 18, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.44.163, hosted on AS13335. It is currently flagged by 3 out of 95 security vendors on VirusTotal, with two additional security blocklists listing it as malicious. The SSL certificate is issued by Google Trust Services (WE1), which, while legitimate, is frequently abused by threat actors to lend false credibility to phishing sites. The domain remains active and unmitigated, posing an ongoing risk to users. Users who have visited ad-5ws.pages.dev or interacted with its content should take immediate action to mitigate potential compromise. Disconnect any devices used to access the site from networks and perform a full antivirus scan to detect potential malware or credential-harvesting scripts. Reset passwords for any accounts accessed during or after the visit, particularly those related to financial services, cryptocurrency wallets, or email accounts. Monitor linked financial accounts for unauthorized transactions and enable multi-factor authentication where available. If personal or financial information was submitted, consider reporting the incident to relevant fraud authorities and credit monitoring services to prevent identity theft or financial loss.