app-phantom-ou[.]pages[.]dev

app-phantom-ou.pages.dev is a Cloudflare‑hosted subdomain that was observed delivering a suspected phishing page titled “Suspected phishing site | Cloudflare”. The site returned HTTP 403, indicating access denial, and the SSL certificate presented is issued by Google Trust Services under the “WE1” label, confirming a valid TLS connection. Registration details show the domain was created on 2 September 2020 through Cloudflare, Inc., and the authoritative nameservers are adi.ns.cloudflare.com, amos.ns.cloudflare.com, karl.ns.cloudflare.com, and sasha.ns.cloudflare.com. The domain resolves to 188.114.96.3, an address owned by AS13335 Cloudflare, Inc., located in the United States. VirusTotal scans recorded 12 detections out of 95 security vendors, and Google Safe Browsing lists the site for social‑engineering content.

The page is also listed on a single security blocklist and has been blocked by the PhishDestroy service. Additional telemetry shows the site employs HSTS, HTTP/3, and the Cloudflare edge network. A Gridinsoft trust score of 0 / 100 further indicates a malicious classification. The campaign is attributed to a crypto‑scam that impersonates the brand “Phantom”, and the risk level has been assigned as high.

Current observations indicate the site has been taken offline, but the infrastructure—particularly the Cloudflare‑provided IP address and the set of nameservers—remains reusable for future campaigns. Defenders should continue to monitor the associated IP block and Cloudflare nameserver set for new subdomains, add the IP 188.114.96.3 to network blocklists, and enforce URL filtering for the “app-phantom-ou.pages.dev” domain and any future derivatives. Users should be warned about unsolicited communications referencing Phantom and directed to verify URLs against known legitimate assets. Ongoing vigilance is required because the underlying hosting provider can rapidly provision replacement domains.