listing-satoshiv[.]pages[.]dev

This domain, listing-satoshiv.pages.dev, is an active phishing site designed to harvest cryptocurrency wallet credentials. Analysis indicates the page mimics legitimate wallet login interfaces, tricking users into entering private keys or recovery phrases. The domain specifically targets users of decentralized finance platforms, leveraging social engineering tactics to induce urgency or fear, such as fake security alerts or transaction confirmations. Once credentials are entered, they are transmitted to attacker-controlled infrastructure, enabling unauthorized access to digital assets. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on March 24, 2026, and remains operational despite its malicious intent. It resolves to the IP address 172.66.44.61, located in Canada, and is hosted on Cloudflare’s content delivery network. The domain appears on two security blocklists and is flagged by 14 out of 95 security vendors on VirusTotal, indicating broad recognition as a phishing threat. The SSL certificate, issued by Google Trust Services (WE1), provides a false sense of security while facilitating encrypted exfiltration of stolen credentials. Users who have visited listing-satoshiv.pages.dev or entered sensitive information should immediately revoke access to any associated wallets. This includes generating new private keys or recovery phrases and transferring assets to a new, secure wallet. It is also recommended to monitor transaction histories for unauthorized activity and report the incident to relevant security teams or threat intelligence platforms. Browser-based security extensions or network-level blocking tools should be configured to prevent future access to this domain and related infrastructure.