encryptwalletlink[.]pages[.]dev

This domain, encryptwalletlink.pages.dev, operates as a brand impersonation threat specifically targeting users of a major social media platform. Analysis indicates the site mimics legitimate login portals to harvest credentials, potentially enabling unauthorized account access, data exfiltration, or secondary attacks such as malware distribution or financial fraud. The infrastructure is designed to exploit trust in recognized brands, leveraging visual and functional similarities to deceive users into disclosing sensitive authentication details. Infrastructure analysis reveals the domain was registered through a privacy-focused provider on January 13, 2025, and resolves to the IP address 172.66.44.236. Detection metrics show 10 out of 95 security vendors on a widely used threat intelligence platform have flagged the domain as malicious. The domain appears on two security blocklists, including high-confidence detection systems, and holds a trust score of 0/100 from independent threat assessment sources. The SSL certificate is issued by a trusted certificate authority, which may further mislead users into perceiving the site as legitimate. Users who visited encryptwalletlink.pages.dev should immediately revoke any entered credentials and enable multi-factor authentication on associated accounts. A full system scan using updated security tools is recommended to detect potential secondary infections. Browser data, including cached credentials and session tokens, should be cleared to mitigate lingering exposure. If financial or personally identifiable information was submitted, affected parties should monitor for unauthorized transactions and consider reporting the incident to relevant fraud protection authorities.