compound-app-preview-staging[.]pages[.]dev

The domain compound-app-preview-staging.pages.dev was created on February 21, 2026 and is currently taken offline, returning HTTP 403 responses. DNS resolution points to IP 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presented the page title "Suspected phishing site | Cloudflare" and is explicitly associated with a crypto‑scam impersonating the brand Compound. The SSL certificate is issued by Google Trust Services under the WE1 identifier, indicating a valid TLS deployment despite the malicious intent.

Infrastructure analysis shows the domain is served behind Cloudflare’s edge, with HSTS and HTTP/3 enabled, and uses the nameservers norm.ns.cloudflare.com and isla.ns.cloudflare.com. Reputation signals include appearance on a single security blocklist and a block by PhishDestroy. VirusTotal scans recorded four positive detections out of ninety‑three vendors, and Gridinsoft assigned a trust score of 0 / 100, reinforcing the malicious classification. Registration details list Cloudflare, Inc. as the registrar, confirming the domain’s rapid provisioning through the provider’s automated services.

While the page title and brand target provide clear evidence of impersonation, the exact content of the site has not been captured, leaving the specific phishing vectors or credential‑collection mechanisms unverified. Defenders should immediately block the domain at perimeter and DNS layers, monitor for any resurgence of the IP address or related Cloudflare‑hosted subdomains, and incorporate the observed indicators—IP 188.114.97.3, SSL issuer Google Trust Services, and the specific page title—into threat‑intel feeds. Ongoing vigilance is advised, especially for users of Compound services, to detect any future attempts that reuse the same branding or hosting patterns.