raccerdot-app[.]pages[.]dev

This domain raccerdot-app.pages.dev was registered on 2024-11-11 through Cloudflare, Inc. It resolves to the Cloudflare‑owned address 172.66.44.179 located in the United States (AS13335). The site serves content over HTTPS with a certificate issued by Google Trust Services / WE1 and enforces HSTS and HTTP/3. The page title returned by the server is "COIN NODE", and the front‑end stack is identified as Bootstrap and jQuery. VirusTotal has flagged the domain in 12 of 91 scanned security vendors, and the domain is currently listed on one public blocklist. PhishDestroy has already blocked the host. The threat profile is classified as a "Crypto Drainer" scam, and the risk level is high with the status marked active. Analysis indicates that the infrastructure is typical of abuse‑hosting services that leverage Cloudflare’s CDN and DNS to obscure origin. No additional payload or credential‑stealing behavior has been observed in the available data, and the exact malicious content beyond the title has not been examined. Defenders should treat the domain as malicious, enforce network‑level deny rules for the IP 172.66.44.179 and the FQDN, and add it to DNS sinkhole or proxy block lists. Continuous monitoring of DNS queries and outbound connections to the host is advised, as well as periodic re‑scanning to capture any changes in vendor detections.