espresso-site[.]pages[.]dev

The domain espresso-site.pages.dev is a phishing site engaged in brand impersonation targeting Amazon. It presents itself as a comparison page for espresso machines but is designed to deceive users into entering sensitive information under the guise of a trusted brand. No crypto drainer kit was identified. The site is currently taken offline, reducing immediate risk but not eliminating the potential for future malicious activity.

Technical indicators confirm the elevated risk level. espresso-site.pages.dev was flagged by 5 of 95 security vendors on VirusTotal, including ADMINUSLabs, ChainPatrol, and alphaMountain.ai. It appears on one security blocklist, PhishDestroy, and is registered through Cloudflare, Inc., with a creation date of July 19, 2025. The domain resolves to IP address 172.66.44.215, hosted on Cloudflare's infrastructure (AS13335) in the US. The SSL certificate is issued by Google Trust Services / WE1, and the observed page title was 'Espresso Machine Comparison - Compare Top Coffee Machines'. Technologies detected include HSTS, Cloudflare, and HTTP/3. Google Safe Browsing has not flagged the domain.

Users who interacted with espresso-site.pages.dev should take immediate steps to secure their accounts. Change passwords for Amazon and any other services where the same credentials may have been reused, and enable two-factor authentication (2FA) where available. Monitor accounts for unauthorized transactions or suspicious activity. Report the phishing domain to Amazon's official abuse channels and to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group to aid in broader mitigation efforts.