momentum-pre[.]pages[.]dev

This domain is flagged as a high-risk generic phishing threat specializing in impersonation of gaming and trading platforms. Analysis indicates it mimics a PvP trading game interface to deceive users into disclosing login credentials or connecting cryptocurrency wallets, enabling unauthorized access and asset theft. Infrastructure analysis reveals the domain resolves to IP 188.114.96.3 (AS13335, Cloudflare, Inc.), registered via Cloudflare with an SSL certificate issued by Google Trust Services (WE1). VirusTotal detection shows 3/95 security vendors flagging the domain, while it appears on 3 security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. The domain was created on February 04, 2026, and remains operational as of this report. Mitigation requires immediate blocking of the domain and its resolving IP at network and endpoint levels. Users should be alerted to verify URLs before entering credentials, particularly for gaming or trading platforms. Cryptocurrency wallet connections should be restricted to verified applications only. Security teams are advised to monitor for related domains using the same Cloudflare Pages infrastructure (pages.dev) and similar SSL certificate patterns.