ai-soldapp[.]pages[.]dev

The domain ai-soldapp.pages.dev is currently active and has been classified as a high‑risk brand‑impersonation operation targeting Cloudflare. Infrastructure analysis shows the domain was registered on July 28 2024 through Cloudflare’s registration service and resolves to IP 188.114.97.3, which belongs to AS13335 Cloudflare, Inc., located in the United States. DNS is served by sullivan.ns.cloudflare.com and naomi.ns.cloudflare.com, both Cloudflare name servers. The site employs HSTS, HTTP/3, and presents a legitimate‑looking SSL certificate issued by Google Trust Services under the WE1 intermediate, which may aid in evading naive certificate checks. HTTP requests return a 500 status code with the page title “Worker threw exception | ai‑soldapp.pages.dev | Cloudflare”, indicating that a Cloudflare‑hosted worker script failed to execute, but no content has been publicly disclosed. The domain appears on three security blocklists (PhishDestroy, ScamSniffer, Enkrypt) and receives a Gridinsoft trust score of 0 / 100, reinforcing its malicious reputation. Intelligence flags the activity as a crypto‑scam, though the exact mechanism (e.g., wallet address theft, fraudulent investment offer) remains unconfirmed. Defenders should proactively block the domain at perimeter and DNS filtering layers, monitor for any outbound connections to the associated IP, and consider sinkholing the host to prevent credential or cryptocurrency harvesting. Continuous observation is advised to capture any future payload changes, as the current evidence is limited to infrastructure and blocking data.