paalai-revshare[.]pages[.]dev

Analysis of paalai-revshare.pages.dev shows a high‑risk brand‑impersonation campaign targeting Google. The domain was registered on March 27, 2026 through Cloudflare, Inc., and resolves to the Cloudflare IP 172.66.45.34 located in Canada. It presents a page titled "Paal AI STAKING" and uses a stack that includes Vue.js, Unpkg, SweetAlert2, jsDelivr, HSTS, crypto‑js, cdnjs, and Cloudflare services. The SSL certificate is issued by Google Trust Services / WE1, which may be intended to increase credibility. Google Safe Browsing flags the site for SOCIAL_ENGINEERING, and three independent blocklists (PhishDestroy, ScamSniffer, Enkrypt) have already listed it. Additional reputation services assign a Gridinsoft score of 0/100 and a Scamadviser rating of 11/100. VirusTotal records six positives out of 94 scanned vendors, reinforcing the malicious classification. The nameservers are nikon.ns.cloudflare.com and princess.ns.cloudflare.com. Current HTTP response is 200, indicating the site is actively serving content. While the exact phishing page content has not been examined, the convergence of brand impersonation, low trust scores, multiple blocklist listings, and detection by several security engines confirms a malicious intent. Defenders should immediately block paalai-revshare.pages.dev at the network perimeter, add it to URL filtering rules, and monitor for related Cloudflare‑hosted IP activity. Continuous observation is advised to detect any further infrastructure changes or new payloads associated with this campaign.