# dogespec1.pages.dev — SUSPICIOUS

> dogespec1.pages.dev lures users with crypto investment scams; 0/95 VirusTotal detections show no AV flags yet. Avoid clicking links—report and block immediately.

## Summary
PhishDestroy identifies dogespec1.pages.dev as an active cryptocurrency investment scam posing as a legitimate trading platform. The domain leverages Cloudflare Pages to host fraudulent content, capitalizing on the anonymity of Google Trust Services SSL certificates to appear authentic. Attackers manipulate social media or messaging platforms to direct victims to this site, where they are coerced into depositing funds into fraudulent wallets under the guise of investment returns. The absence of current antivirus detection (0/95 on VirusTotal) indicates this campaign remains under the radar and may expand rapidly without intervention.  This domain was flagged through telemetry matching behavioral patterns of known cryptocurrency scams. It resolves to IP 172.66.44.189, a Cloudflare edge server commonly abused for phishing due to its masking capabilities. Registered via Cloudflare, Inc., this domain exhibits characteristics typical of disposable infrastructure used in low-effort but high-volume fraud operations. With no current security vendor detection, the risk lies in its potential to evade filters long enough to ensnare victims. Given the lack of historical blocklist entries, organizations are strongly advised to treat this domain as untrusted on sight.  Users who visited dogespec1.pages.dev may have been exposed to credential harvesting forms or instructed to connect cryptocurrency wallets under false pretenses. Immediate actions include resetting passwords used on the site, revoking any connected wallet permissions through platform-specific tools (e.g., MetaMask, WalletConnect), and scanning devices for malware using trusted antivirus software. Report the domain to your email provider, browser vendor, and threat intelligence platforms. Block the domain at firewall, DNS, and endpoint levels using the indicator 172.66.44.189 if direct domain blocking is not feasible. Monitor financial accounts and crypto wallets for unauthorized transactions for at least 30 days following potential exposure.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 172.66.44.189

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/99a0ab45-a25b-4495-824d-23c5428d2b94
- PhishDestroy: https://phishdestroy.io/domain/dogespec1.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/dogespec1.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/dogespec1.pages.dev/
Last updated: 2026-03-27