cryptoall-stars[.]pages[.]dev

Analysis of cryptoall-stars.pages.dev, first observed in September 2024, indicates that the domain is actively leveraged for phishing attacks. The domain resolves to the IPv4 address 188.114.97.3, which is hosted behind Cloudflare Pages, a service commonly abused for rapid deployment of malicious pages. Registration data shows the domain was created on 23 September 2024 and the registrar is listed as Cloudflare Pages, confirming the use of a free or low‑cost hosting platform. Multiple independent threat‑intel feeds have flagged the domain. PhishDestroy, MetaMask, ScamSniffer, and SEAL have all listed it as blocked, and four external blocklists currently contain the domain.

VirusTotal analysis shows that 12 of 91 security vendors have raised detections on the domain, reinforcing the suspicion of malicious activity. The presence of detections across multiple vendors and blocklists demonstrates a consensus among security products that the site is hostile. No public page title or content has been provided, so the exact phishing lure (e.g., credential harvesting for a specific brand) remains unknown. Likewise, details such as SSL certificate fingerprints, HTTP response codes, or redirects have not been disclosed, limiting deeper technical attribution.

However, the convergence of registration, hosting, and detection evidence is sufficient to classify the infrastructure as a high‑risk phishing vector. Defenders should add cryptoall-stars.pages.dev to network‑level deny lists, update DNS filtering policies, and monitor for any outbound connections to the associated IP address 188.114.97.3. Incident response teams encountering credential captures or malicious redirects should treat any traffic to this domain as compromised and isolate affected endpoints. Continuous re‑scanning of the domain on multi‑vendor platforms is advised to capture any evolution in the payload or hosting configuration.