pionexproduction[.]pages[.]dev

This domain is flagged as a high-risk crypto phishing site targeting users of automated trading platforms. Analysis indicates the site mimics legitimate cryptocurrency trading bot services, specifically impersonating the Pionex brand to deceive victims into disclosing credentials or transferring funds. The threat type is classified as credential harvesting with financial fraud intent, a common tactic in cryptocurrency-related phishing campaigns. Infrastructure analysis reveals the domain pionexproduction.pages.dev was registered on June 01, 2025, through Cloudflare, Inc. It resolves to the IP address 172.66.45.26, hosted on autonomous system AS13335 operated by Cloudflare, Inc. in the United States. The SSL certificate is issued by Google Trust Services, serial number WE1, a common configuration for phishing sites leveraging free hosting services. Detection metrics show 1 out of 95 security vendors on VirusTotal have flagged the domain, while it appears on one additional security blocklist. The page title, Pionex Trading Bots - Automate Your Crypto Strategy, directly mirrors legitimate branding to enhance credibility. Mitigation steps for this threat type include immediate blocking of the domain and its resolving IP address across all network security controls. Organizations should deploy indicators of compromise (IOCs) including the domain pionexproduction.pages.dev, IP 172.66.45.26, and SSL certificate fingerprint WE1 to endpoint detection systems. Users should be educated to verify domain authenticity before entering credentials, particularly for financial or cryptocurrency-related services. Security teams are advised to monitor for additional domains registered through the same registrar with similar naming patterns, as phishing campaigns often employ multiple lookalike domains in rapid succession.