cake-moneyfi-sdk[.]pages[.]dev

Analysis of the domain cake-moneyfi-sdk.pages.dev, observed on July 29, 2026, indicates active phishing infrastructure with elevated risk. The domain was registered on April 28, 2026 through Cloudflare Pages, a service that provides static site hosting and automatically provisions SSL certificates. DNS resolution points to the IP address 188.114.96.3, which is associated with Cloudflare’s edge network and is commonly used by malicious actors to obscure the true origin of phishing sites. VirusTotal has recorded nine positive detections out of ninety‑one submitted security scanners, confirming that multiple independent engines have identified malicious behavior associated with the domain.

The same domain appears on three separate public blocklists and is explicitly listed by PhishDestroy, MetaMask, and SEAL as a malicious site, reinforcing the consensus that the domain is being used for phishing purposes. The available evidence does not include a page title, HTTP response codes, or SSL certificate details, so the exact content served by the site remains unverified. Likewise, no public threat‑intel feeds such as OTX have published additional context for this domain. The lack of further technical artifacts limits attribution, but the combination of recent registration, Cloudflare Pages hosting, multiple vendor detections, and inclusion on established blocklists is sufficient to classify the domain as a confirmed phishing site.

Defenders should block traffic to cake-moneyfi-sdk.pages.dev at both network perimeter and endpoint layers. Updating DNS‑based filtering services with the domain, adding the IP address 188.114.96.3 to deny lists, and ensuring that browser‑based safe‑browsing protections are enabled will reduce exposure. Continuous monitoring of Cloudflare‑hosted subdomains is advised, as the attacker may generate additional variants under the same registrar.