typusfiinance[.]pages[.]dev

This domain, typusfiinance.pages.dev, is identified as a high-risk generic phishing site targeting users of Typus Finance, a decentralized finance platform. Analysis indicates the site is designed to harvest credentials or facilitate unauthorized transactions, likely through a cryptocurrency drainer kit, though no specific kit has been confirmed. The domain mimics the legitimate Typus Finance branding, including its page title, to deceive visitors into interacting with malicious infrastructure. Infrastructure analysis reveals the domain was registered on March 28, 2026, through Cloudflare, Inc., and resolves to the IP address 172.66.47.188, located in California. Despite its recent creation, the domain has already been flagged by 4 security blocklists, including PhishDestroy, MetaMask, ScamSniffer, and SEAL. VirusTotal reports 0 out of 95 detections, indicating the threat may still be evading some automated detection systems. The SSL certificate is issued by Google Trust Services (WE1), providing a false sense of security to unsuspecting users. The domain remains active as of this assessment, posing an ongoing risk to individuals interacting with decentralized finance platforms. Response actions by security providers have included blocklisting, but the site continues to operate under Cloudflare's hosting infrastructure. Users are advised to avoid interaction with the domain, verify URLs before accessing financial platforms, and employ browser-based security extensions to block known phishing sites. The combination of low VirusTotal detections and high blocklist prevalence suggests this is a targeted or emerging threat requiring heightened vigilance.