telcoins-bank-net[.]pages[.]dev

The domain telcoins-bank-net.pages.dev is currently active and resolves to the Cloudflare‑owned address 172.66.44.159, which is geolocated to Canada. It is hosted on Cloudflare Pages and presents a valid SSL certificate issued by Google Trust Services under the WE1 root. HTTP requests return status code 200, indicating a reachable web service. Independent blocklists from PhishDestroy, MetaMask, and SEAL have already listed the domain, and it appears on three additional security blocklists. VirusTotal analysis shows three of ninety‑one scanners flag the domain as malicious, reinforcing the suspicion of a phishing operation. The intelligence points to a banking‑phishing campaign, but the exact lure, credential‑stealing page content, and target financial institutions have not been publicly disclosed. Given the high risk rating, security teams should prioritize this indicator in threat‑intel feeds, ensure email security gateways flag any messages containing the domain, and add the domain to network and endpoint blocklists. Defenders should continue to monitor DNS queries for the 172.66.44.159 address and observe for any changes in hosting or additional payloads.