o-cd1e0cfc[.]pages[.]dev

Analysis identifies o-cd1e0cfc.pages.dev as an active brand impersonation threat. The observed content is consistent with deceptive infrastructure designed to imitate a legitimate digital-asset service and attract user interaction through misleading branding and referral-themed messaging. At the time of review, the domain remains active and continues to present exposure risk to visitors.

Infrastructure analysis reveals that the domain resolves to IP address 162.159.153.4 and is associated with AS13335. Registration records indicate a creation date of November 30, 2025, with registration handled through Cloudflare, Inc. The domain has no SSL certificate reported in the available intelligence. Detection telemetry shows that 3 of 95 security vendors flag the domain, and the resource appears on 1 security blocklist. Additional reporting indicates blocking by PhishDestroy. These indicators collectively support classification as a high-risk brand impersonation operation.

Current monitoring data shows the domain is still active. Security teams should maintain blocking controls for the domain and associated indicators, monitor for related infrastructure, and investigate any historical connections involving the resolved IP. Users should avoid interacting with the site, submitting credentials, connecting wallets, or following referral instructions. Any observed access attempts should be reviewed for potential compromise, and affected systems should undergo credential, session, and account-security validation procedures.