pre-tge-claim[.]pages[.]dev

The domain pre-tge-claim.pages.dev was registered on November 18, 2025 and is currently hosted behind Cloudflare’s network (AS13335, United States). DNS resolution points to the IPv6 address 2a06:98c1:3120::3 and the authoritative nameservers are bingo.ns.cloudflare.com and noel.ns.cloudflare.com. The site presented a page titled "WalletConnect: The Connectivity Layer For The Financial Internet" and was classified as a wallet/seed phishing campaign that impersonates the Solana brand. Security tooling on VirusTotal recorded 15 detections out of 95 scanners, indicating a moderate level of malicious confidence.

The page employed HSTS and HTTP/3, and the TLS certificate was issued by Google Trust Services under the WE1 identifier, confirming a valid HTTPS endpoint despite the malicious intent. HTTP requests returned a 403 status code before the infrastructure was taken offline, and the domain now appears on a single security blocklist and is blocked by the PhishDestroy service. Independent reputation scoring from Gridinsoft gave the domain a zero‑out‑of‑hundred trust score, reinforcing its malicious nature.

While the exact phishing landing page content has not been captured, the combination of brand impersonation, wallet‑related lure, and the observed technical indicators strongly suggest a credential‑stealing operation targeting Solana users. Defenders should add pre-tge-claim.pages.dev to deny‑list or firewall rules, monitor for any C2 traffic to the associated Cloudflare IP range, and educate users about unsolicited Solana‑related wallet prompts. Continuous threat‑intel feeds should be consulted for any re‑use of the same nameservers or TLS certificate in future campaigns, as the infrastructure pattern may be reused by related actors.