dapp-security-demo[.]pages[.]dev

Analysis of dapp-security-demo.pages.dev shows an active infrastructure built on Cloudflare’s edge network (AS13335) with the IP address 104.21.80.1 located in the United States. The domain was registered on February 21, 2026 through Cloudflare, Inc., and the TLS certificate is issued by Google Trust Services under the WE1 designation, with HSTS enforced and HTTP/3 enabled. Web‑technology fingerprinting reveals a stack comprising React, Gatsby, Webpack, and Cloudflare services, indicating a modern JavaScript‑driven site. Security‑vendor scanning on VirusTotal recorded 2 detections out of 91 scanners, and the site is listed on a single public blocklist. Gridinsoft assigns a trust score of 0 / 100, and the domain is already blocked by PhishDestroy. The known intelligence tags the site as a crypto‑related scam that impersonates the Metamask brand. No content analysis is available, so the exact page layout, credential‑capture mechanisms, or malicious payloads remain unverified. Defenders should treat the domain as high‑risk: add the hostname to network‑level deny lists, update URL filtering rules, and monitor for any outbound connections to the resolved IP. Continued observation of the host’s activity and periodic rescanning are recommended to capture any changes in detection status or additional malicious behavior.