water-3pl[.]pages[.]dev

Analysis of the domain water-3pl.pages.dev indicates an active brand impersonation phishing campaign targeting the $WATER token, as evidenced by the page title '$WATER - OFFICIAL WEBSITE'. The domain was registered on June 22, 2024, through Cloudflare, Inc., and currently resolves to the IP address 188.114.97.3, associated with AS13335 (Cloudflare, Inc.) in the United States. Infrastructure analysis reveals the use of Cloudflare nameservers (gannon.ns.cloudflare.com and mckinley.ns.cloudflare.com), alongside security technologies such as HSTS, Google Tag Manager, Google Analytics, and HTTP/3, which may be employed to lend an appearance of legitimacy or to evade detection. The domain is flagged on three security blocklists and is actively blocked by multiple detection services. A Gridinsoft trust score of 0/100 and a Scamadviser trust score of 11/100 further corroborate its malicious classification. The SSL certificate is issued by Google Trust Services (WE1), a common feature in both legitimate and malicious domains leveraging Cloudflare infrastructure. While only 2 of 93 security vendors on VirusTotal currently flag the domain, this limited detection does not diminish the confirmed risk, as phishing campaigns often evade initial scans through obfuscation or rapid infrastructure changes. The exact content and functionality of the site remain unanalyzed, but the combination of brand impersonation, low trust scores, and active blocklisting strongly suggests an intent to deceive users into disclosing sensitive information or transferring assets. Defenders should treat this domain as high-risk and prioritize blocking or monitoring traffic to and from 188.114.97.3 and associated subdomains. Further investigation into the campaign's distribution methods and payload delivery mechanisms is recommended to mitigate potential impact.