ddgghb[.]pages[.]dev

This report documents the active malicious infrastructure hosted at ddgghb.pages.dev. The domain was created on July 01 2024 through Cloudflare, Inc. and resolves to the IP address 172.66.45.20, which belongs to AS13335 (Cloudflare) located in the United States. HTTP requests return a 200 status code and the page presents the title “Ton Minter”, while the site explicitly impersonates the foundation brand. The risk rating is high and the unique seed identifier is 1dbc7e. The underlying web stack is fully provisioned by Cloudflare. Authoritative name servers are howard.ns.cloudflare.com and sloan.ns.cloudflare.com, and the TLS certificate is issued by Google Trust Services under the WE1 label, enforcing HSTS and HTTP/3. Front‑end libraries detected include SweetAlert2, jsDelivr, cdnjs, and Google Analytics, together with Cloudflare Browser Insights. These components are commonly observed in credential‑harvesting kits that present deceptive dialogs to lure victims. VirusTotal analysis shows that only one of ninety‑five security vendors flagged the domain, indicating limited detection coverage. Reputation services assign extremely low trust scores (Scamadviser 1/100, Gridinsoft 0/100), and the domain is already listed on three public blocklists, including PhishDestroy, ScamSniffer, and Enkrypt. The page title “Ton Minter” aligns with a cryptocurrency‑minting scam narrative, suggesting the actors aim to trick donors or supporters of the foundation into sending digital assets. Defenders should treat ddgghb.pages.dev as a high‑confidence malicious indicator. Immediate actions include adding the fully qualified domain to URL filtering and DNS sinkhole policies, monitoring for additional pages.dev subdomains that exhibit similar technology fingerprints, and alerting end‑users about the fake foundation impersonation. Continuous intelligence gathering is recommended to capture any evolution of the site’s content or the introduction of payloads.