dgtl[.]pages[.]dev

The domain dgtl.pages.dev was observed serving a page titled "Connect Wallet" before being taken offline. HTTP response codes indicate the site returned a 403 status, suggesting restricted access or a deliberate block. Infrastructure analysis shows the domain is registered through Cloudflare, Inc., and resolves to the IP address 172.66.47.85, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The TLS certificate presented is issued by Let’s Encrypt (E7), confirming the use of a valid, publicly trusted certificate.

Nameserver records list alex.ns.cloudflare.com and daphne.ns.cloudflare.com, consistent with the registrar information. Reputation data reveals the domain is flagged by one security blocklist and has been blocked by PhishDestroy. Gridinsoft assigns a trust score of 0 out of 100, indicating a high likelihood of malicious intent. VirusTotal analysis shows that 1 out of 91 scanning engines flagged the domain, providing an additional indicator of compromise.

The combination of a wallet‑related page title, low trust score, blocklist presence, and a single vendor detection suggests the site was employed as a generic phishing lure targeting cryptocurrency wallet users. Defenders should add dgtl.pages.dev to URL filtering rules, monitor DNS logs for any re‑resolution to the same IP, and consider proactive blocking at perimeter devices. Continuous watch of Cloudflare‑hosted IP ranges for re‑use of the same infrastructure is advised, as threat actors often recycle hosting assets after takedown. Since the site is currently offline, incident response can focus on containment and updating threat intelligence feeds to prevent future exposure.