celo-3ae[.]pages[.]dev

This domain, celo-3ae.pages.dev, is actively distributing a fake crypto wallet interface designed to drain funds from victims' digital wallets. Analysis indicates the site mimics Celo Marketing LLC, a legitimate entity, to deceive users into connecting their wallets. The fraudulent page prompts visitors to authorize transactions, which are then exploited to siphon cryptocurrency without consent. The threat specifically targets users familiar with Celo or similar blockchain platforms, leveraging social engineering to bypass security awareness. Infrastructure analysis reveals the domain was registered on March 13, 2026, through Cloudflare, Inc., and resolves to the IP address 172.66.47.161, hosted on Cloudflare's network (AS13335). Security vendors on VirusTotal have flagged the domain, with 3 out of 95 engines detecting malicious activity. The domain appears on three security blocklists, including those maintained by cryptocurrency-focused threat intelligence providers. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the risk, as the domain remains operational and unrevoked. Users who have visited celo-3ae.pages.dev and connected a wallet should immediately revoke any active session permissions granted to the site. This can be done through the wallet's connected apps or dApps management interface. Additionally, affected users should transfer remaining funds to a new wallet address and monitor their transaction history for unauthorized activity. If credentials or recovery phrases were entered, assume full compromise and migrate all assets to a new, secure wallet. No further interaction with the domain should occur, and any cached data or browser sessions associated with the site should be cleared.