azukielementalscollection[.]pages[.]dev

Analysis of azukielementalscollection.pages.dev shows a domain that was registered on February 21, 2026 through Cloudflare, Inc. and is served from the Cloudflare network (AS13335). DNS resolution points to IP address 172.66.47.167, which is located in the United States and belongs to the same Cloudflare infrastructure. The site employed modern transport features, including HTTP Strict Transport Security and HTTP/3, and presented a valid SSL certificate issued by Google Trust Services under the WE1 label. An HTTP request returned a 403 status, indicating that the server is currently refusing access, consistent with the reported offline status.

The page title returned by the server is "Azuki Elementals," but no further content has been captured because the endpoint is no longer reachable. Reputation services assign extremely low trust scores: Gridinsoft rates the domain 0 / 100 and Scamadviser 11 / 100. The domain appears on three independent blocklists—PhishDestroy, ScamSniffer, and Enkrypt—and is listed on three security blocklists overall. VirusTotal records show that the domain was scanned by 93 AV engines, none of which flagged it; this absence of detections does not constitute evidence of benign intent.

The classified scam type is Wallet/Seed Phishing, suggesting an attempt to harvest cryptocurrency wallet credentials or seed phrases. Given the combination of a newly created domain, low trust scores, blocklist presence, and the specific phishing categorisation, defenders should treat the domain as malicious. Recommended mitigations include adding the domain and its resolving IP to network deny lists, enforcing DNS‑level blocking, and monitoring for any future re‑activation of the domain or related Cloudflare‑hosted assets. Continuous observation of Cloudflare‑associated IP ranges for similar patterns is advised, as threat actors frequently reuse this infrastructure for credential‑stealing campaigns.