cyrusfinance[.]pages[.]dev

The domain cyrusfinance.pages.dev was observed on 23 July 2026 as a high‑risk brand impersonation campaign targeting users of the decentralized exchange aggregator 1inch. The site was registered on 4 March 2026 through Cloudflare, Inc., and its DNS records point to the Cloudflare‑managed nameservers joan.ns.cloudflare.com and wells.ns.cloudflare.com. Resolution resolves to the IP address 172.66.47.179, which is announced by AS13335 (Cloudflare, Inc.) and geolocated to the United States. The HTTPS layer is provided by a Let’s Encrypt certificate (issuer E7) and the server advertises HSTS, HTTP/3, and other Cloudflare services. An HTTP request to the root URL returns a 403 status code, indicating that the site is no longer serving content; the current status is reported as offline.

VirusTotal analysis shows that 12 of 94 scanned security vendors flagged the domain, and the domain appears on three independent blocklists. Additional blocklist signatures from PhishDestroy, MetaMask, and SEAL have also been applied, confirming that protective products have identified it as malicious. The Gridinsoft trust score is 0 out of 100, reinforcing the malicious classification. The page title returned by the server is “Cyrus Finance | Crypto IDO Launchpad”, which does not reference the impersonated brand but suggests a cryptocurrency launchpad theme. The campaign’s declared intent is wallet/seed phishing, aiming to harvest private keys or seed phrases from victims who believe they are interacting with a legitimate 1inch service.

Evidence is limited to infrastructure and metadata; the actual content of the landing page has not been captured, so the precise user‑experience and credential‑capture mechanisms remain uncertain. Defenders should continue to block the domain at DNS and web gateway layers, monitor for any resurgence of the host, and enforce detection rules for the associated IP address and Cloudflare‑origin AS.