propayacc[.]pages[.]dev

This domain is classified as a high-risk credential harvesting phishing site targeting cryptocurrency wallet users. Analysis indicates the infrastructure was designed to mimic legitimate payment authorization portals, likely to capture sensitive login credentials, private keys, or recovery phrases. The threat type aligns with targeted phishing campaigns aimed at digital asset theft, a common vector for financial fraud in the cryptocurrency ecosystem. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc., with an SSL certificate issued by Google Trust Services (WE1). It resolves to IP address 172.66.47.172, geolocated to the United States under AS13335 (Cloudflare, Inc.). The domain was created on March 06, 2026, though it has since been taken offline. Detection metrics show 10 out of 95 security vendors on VirusTotal flagged the domain as malicious. It appears on three independent security blocklists and is actively blocked by multiple threat intelligence feeds, including those focused on cryptocurrency fraud prevention. The page title, 'Suspected phishing site | Cloudflare,' further corroborates its malicious classification. Mitigation requires immediate action from network defenders and end users. Network-level protections should include DNS sinkholing or firewall rules to block resolution of propayacc.pages.dev and its associated IP (172.66.47.172). Endpoint security tools should be configured to detect and prevent access to known phishing domains, particularly those impersonating payment or wallet services. Users who may have interacted with the domain should revoke any active sessions, rotate credentials for associated accounts, and monitor for unauthorized transactions. Cryptocurrency wallet holders are advised to verify domain authenticity before entering sensitive information and to use hardware-based or multi-factor authentication methods to mitigate credential theft risks.