ethereum-sniperbot[.]pages[.]dev

The domain ethereum-sniperbot.pages.dev has been identified as a high-risk phishing infrastructure specifically designed for brand impersonation targeting Ethereum. Analysis confirms the domain is currently offline, though it previously hosted content mimicking legitimate Ethereum-related services to deceive users into disclosing sensitive credentials or transferring assets. Infrastructure analysis reveals the domain was created on September 2, 2020, and is registered through Cloudflare, Inc. It resolves to the IP address 172.66.44.104, located within the United States under AS13335 (Cloudflare, Inc.). The SSL certificate is issued by Google Trust Services (WE1). Security telemetry indicates the domain is flagged by 12 of 95 vendors on VirusTotal, appears on three independent security blocklists, and is explicitly labeled as phishing by Google Safe Browsing. The page title, 'Suspected phishing site | Cloudflare,' further corroborates its malicious classification. Current status confirms the domain has been taken offline, though historical activity and residual risk remain. Organizations and users are advised to block the domain and associated IP (172.66.44.104) at the network perimeter. Security teams should monitor for related domains leveraging similar naming conventions (e.g., 'sniperbot,' 'ethereum') or Cloudflare Pages infrastructure. End-users should verify the authenticity of any Ethereum-related service by cross-referencing official documentation and avoiding interaction with unsolicited or untrusted links. Proactive threat hunting for indicators of compromise (IOCs) associated with this domain is recommended to identify potential prior exposure.