io-phomts-let[.]pages[.]dev

This domain is flagged as a high-risk crypto wallet credential harvester, a specific subset of phishing infrastructure designed to steal private keys and recovery phrases from cryptocurrency users. Analysis indicates the site impersonated legitimate wallet interfaces to trick victims into disclosing sensitive authentication details, enabling unauthorized access to digital assets. Infrastructure analysis reveals the domain io-phomts-let.pages.dev was registered through Cloudflare, Inc. on April 06, 2026, with an SSL certificate issued by Google Trust Services. The domain resolved to IP address 188.114.97.3 and appeared on three security blocklists. Detection engines flagged the domain in 11 out of 95 scans, while independent trust scoring systems assigned a 0/100 trust rating. The site was subsequently taken offline, though residual DNS and certificate artifacts may persist. Mitigation against crypto wallet credential harvesters requires multi-layered defenses. Network-level protections should include blocking known malicious IPs and domains at the firewall or DNS resolver level, particularly those associated with newly registered or short-lived domains. Endpoint protections should enforce application allowlisting to prevent unauthorized browser extensions or wallet software from executing. User education must emphasize verifying SSL certificates, domain authenticity, and avoiding input of private keys or recovery phrases into web forms, regardless of apparent legitimacy.