koifinance-rewards-june14[.]pages[.]dev

This domain is an active cryptocurrency phishing site targeting users of Koi Finance, a decentralized finance platform. The page presents itself as a legitimate rewards distribution portal, likely designed to harvest wallet credentials, private keys, or seed phrases under the pretense of claiming tokens or bonuses. The use of a rewards-themed subdomain (rewards-june14) suggests a time-sensitive lure, a common tactic to pressure victims into immediate interaction without scrutiny. The site employs HTTPS via a Google Trust Services certificate, which may mislead users into perceiving it as secure despite its malicious intent. Analysis indicates the domain was registered through Cloudflare Pages on April 16, 2026, though this date may reflect automated platform assignment rather than attacker-controlled registration. Infrastructure analysis reveals it resolves to 188.114.96.3, an IP address geolocated in Canada and associated with Cloudflare’s content delivery network. The domain appears on two security blocklists and is flagged by one of 95 security vendors on VirusTotal, indicating limited but growing detection. The SSL certificate (Google Trust Services / WE1) is consistent with Cloudflare’s managed hosting environment, which attackers frequently exploit due to its free tier and ease of deployment. Users who visited koifinance-rewards-june14.pages.dev should assume their wallet credentials or private information may have been compromised. Immediate actions include revoking any connected wallet permissions, transferring assets to a new wallet, and scanning devices for malware. No transactions should be authorized from the exposed wallet until a full security audit is conducted. Given the domain’s active status and targeted nature, affected users should monitor for follow-up phishing attempts via email or social engineering. Organizations should update blocklists to include this domain and its resolving IP to prevent further exposure.