wormhole-ui[.]pages[.]dev

Analysis of wormhole-ui.pages.dev shows a high‑risk brand‑impersonation campaign targeting the Wormhole service. The domain was created on February 21, 2026 and is hosted behind Cloudflare’s network (AS13335, United States) at IP address 188.114.96.3. The site presents the page title "Suspected phishing site | Cloudflare" and returns an HTTP 403 status, indicating intentional access denial after detection. SSL is issued by Google Trust Services under the WE1 certificate, confirming a valid TLS endpoint but not mitigating the malicious intent.

Reputation services uniformly flag the domain as unsafe: Gridinsoft assigns a trust score of 0 / 100, while VirusTotal records 15 of 93 security vendors labeling the host as malicious. Google Safe Browsing classifies the URL as social‑engineering, and three independent blocklists (PhishDestroy, MetaMask, SEAL) have already added it to their deny lists. The domain resolves through Cloudflare’s nameservers razvan.ns.cloudflare.com and veda.ns.cloudflare.com, and passive fingerprinting reveals HSTS and HTTP/3 support, typical of legitimate Cloudflare‑protected sites but also leveraged by threat actors to conceal infrastructure.

Current evidence confirms the site is offline, yet the presence on multiple blocklists and the detection count suggest active distribution of the malicious URL prior to takedown. Defenders should continue to block the IP 188.114.96.3 and the domain wormhole-ui.pages.dev at DNS and proxy layers, monitor for any re‑registration attempts, and enforce user awareness campaigns referencing the Wormhole brand impersonation. Ongoing vigilance is advised, as the underlying infrastructure (Cloudflare) can be rapidly repurposed for future campaigns.