buidlpads[.]pages[.]dev

On 24 July 2026, buidlpads.pages.dev was identified as a brand‑impersonation infrastructure targeting the brand “across”. The domain was registered through Cloudflare, Inc. on 21 February 2026 and is hosted on Cloudflare’s network (AS13335) with the IP address 172.66.44.152 located in the United States. DNS resolution uses the Cloudflare‑provided name servers holly.ns.cloudflare.com and otto.ns.cloudflare.com. TLS is supplied by Google Trust Services under the WE1 certificate, and the site enforces HSTS and serves HTTP/3 traffic.

An HTTP request returns a 403 status code, indicating that the site is currently inaccessible; the status field confirms that the domain has been taken offline. Reputation data shows a Gridinsoft trust score of 0/100 and a blocklisting by PhishDestroy, with the domain appearing on one additional security blocklist. VirusTotal analysis recorded six positive detections out of ninety‑three scanners, reinforcing the malicious classification. The page title returned by the server is “Decentralised”, but no further content has been captured, leaving the exact phishing payload or credential‑capture mechanisms unknown.

Defenders should continue to block the domain at perimeter filters, add the IP address 172.66.44.152 to deny‑list rules, and monitor for any re‑registration or reuse of the same name servers. Because the site is presently offline, active probing is limited, but continuous observation of Cloudflare‑originated domains that reference the “across” brand is advised to detect potential re‑deployment. The combination of low trust scores, multiple vendor detections, and confirmed brand impersonation justifies a heightened security posture for any traffic associated with this domain.