apdao-dapp-bd1[.]pages[.]dev

On 24 July 2026, apdao-dapp-bd1.pages.dev was identified as part of an investment‑focused phishing campaign. The domain was registered through Cloudflare on 21 February 2026 and resolves to the IP address 172.66.47.107, which resides in the United States under ASN 13335 (Cloudflare, Inc.). DNS resolution uses the Cloudflare nameservers adele.ns.cloudflare.com and rene.ns.cloudflare.com, indicating the infrastructure is fully hosted behind Cloudflare’s edge network. HTTP requests return a 403 status code and the page title reported by the server is “Suspected phishing site | Cloudflare”, confirming that the site has been taken offline and is being presented by Cloudflare’s default block page. Security telemetry shows that eight of ninety‑five VirusTotal scanners flagged the domain, and Google Safe Browsing classifies it as a social‑engineering threat.

The site appears on a single external blocklist and has been explicitly blocked by the PhishDestroy service. Additional reputation data include a Gridinsoft trust score of 0 out of 100, reinforcing the malicious assessment. The SSL certificate presented is issued by Google Trust Services under the WE1 designation, which is typical for Cloudflare‑proxied domains and does not mitigate the underlying risk. The only publicly disclosed malicious activity type is an “investment scam”, suggesting that the domain was likely used to lure victims into fraudulent financial offers. No further details about the specific lure, compromised credentials, or victim demographics have been released.

Because the domain is currently offline, active exploitation appears to have ceased, but the infrastructure—particularly the Cloudflare‑protected IP and nameserver configuration—could be repurposed for future campaigns. Defenders should continue to monitor the IP 172.66.47.107 and the associated Cloudflare ASN for any resurgence of malicious content.