info-sophon-dww[.]pages[.]dev

Analysis of the domain info-sophon-dww.pages.dev indicates it was a suspected phishing site hosted on Cloudflare Pages infrastructure. The domain, registered through Cloudflare, Inc. on March 12, 2026, resolved to the IP address 172.66.44.174, associated with Cloudflare's AS13335 in the United States. Nameservers dave.ns.cloudflare.com and piper.ns.cloudflare.com were in use, and the SSL certificate was issued by Google Trust Services (WE1). The site employed security technologies including HSTS and HTTP/3, which are not uncommon for legitimate services but may also be leveraged by threat actors to lend credibility to malicious pages.

At the time of investigation, the domain returned an HTTP 403 status, and its page title was explicitly flagged by Cloudflare as 'Suspected phishing site.' The domain appeared on three security blocklists, including PhishDestroy, MetaMask, and SEAL, suggesting prior detection by anti-phishing tools. Gridinsoft assigned a trust score of 0/100, further indicating high suspicion. While 94 vendors scanned the domain via VirusTotal, none currently flagged it as malicious; however, the absence of detections does not confirm safety, particularly for newly registered or recently taken-down domains. The exact nature of the phishing content remains unconfirmed, as no brand target or scam type was specified in available data.

The domain has since been taken offline, limiting further analysis. Defenders are advised to treat this domain as compromised and maintain its inclusion in blocklists until additional intelligence confirms its disposition. Monitoring for re-registration or similar domains under Cloudflare Pages or other content delivery networks is recommended, given the recurring use of such platforms in phishing campaigns.