leveredge-claim[.]pages[.]dev

leveredge-claim.pages.dev was observed pointing to the Cloudflare edge address 172.66.44.178, which belongs to ASN 13335 owned by Cloudflare, Inc. The domain was created on 21 February 2026 and is registered through Cloudflare, Inc., using the authoritative name servers sierra.ns.cloudflare.com and valentin.ns.cloudflare.com. The TLS certificate presented is issued by Google Trust Services under the WE1 label, and the site advertises HSTS and HTTP/3 support. An HTTP request returns a 403 status code and the page title is “Suspected phishing site | Cloudflare”, indicating that Cloudflare has taken the site down. VirusTotal records show that 2 of 95 scanned security vendors flagged the domain, and the domain appears on five independent blocklists, including PhishDestroy, ScamSniffer, Polkadot, Enkrypt and Codeesura.

Gridinsoft assigns a trust score of 0 / 100, and the overall risk rating is elevated. The intelligence classifies the activity as a crypto‑drainer scam. No additional payload, landing page content, or target cryptocurrency address has been disclosed, leaving the exact mechanism of the drain unknown. The presence of HSTS suggests the site attempted to enforce secure transport, but the 403 response indicates that the content is no longer reachable.

The low detection count on VirusTotal does not preclude malicious intent, as the domain has already been flagged by multiple specialized anti‑phishing services. Because the domain resolves to a shared Cloudflare edge, attribution to a single actor is limited, and future re‑use of the same sub‑domain or a similar naming pattern cannot be ruled out. Organizations should also review internal logs for any recent authentication attempts to cryptocurrency wallets or exchanges that coincide with the domain’s creation window. Given the elevated risk level, inclusion of the domain in threat‑intel feeds and SIEM correlation rules is recommended.