cvbnm-99l[.]pages[.]dev

Analysis of the domain cvbnm-99l.pages.dev indicates a high-risk phishing operation targeting cryptocurrency wallet users. The domain, registered on June 17, 2026, through Cloudflare, Inc., remains active as of July 12, 2026. The page title 'Import Wallet' suggests an attempt to deceive users into entering sensitive credentials, likely for wallet recovery or seed phrase theft. Infrastructure analysis reveals the domain resolves to IP address 188.114.97.3 and employs Cloudflare-hosted services, including HTTP/3 and HSTS, which may be leveraged to obfuscate malicious activity. The SSL certificate is issued by Google Trust Services, a common feature in both legitimate and malicious domains. The domain appears on one security blocklist and is flagged by 2 of 95 vendors on VirusTotal, though the specific detection context is not detailed. Gridinsoft assigns a trust score of 0/100, reinforcing its classification as malicious. No evidence confirms the exact wallet software or brand being impersonated, as the page content has not been fully analyzed. Defenders should prioritize blocking this domain at the DNS or network level, particularly in environments where cryptocurrency-related activity occurs. Monitoring for connections to 188.114.97.3 or related Cloudflare-hosted subdomains may help identify compromised systems. Further investigation is required to determine the full scope of the phishing kit or payload delivery mechanism, if any.