sdg423432[.]pages[.]dev

The domain sdg423432.pages.dev was created on March 24, 2026 and is presently listed as offline. The site presented the page title “Microsoft Digital Asset Token Presale is Live! Secure Your MST Tokens with Exclusive Offers,” directly targeting the Microsoft brand and fitting the documented scam type of brand impersonation. Technical analysis shows the domain resolves to IP address 188.114.97.3, which is owned by Cloudflare, Inc. and geolocated to Canada. Registration information confirms the domain is hosted through Cloudflare, Inc., with authoritative nameservers jarred.ns.cloudflare.com and maya.ns.cloudflare.com.

The TLS certificate is issued by Google Trust Services under the WE1 root, indicating a valid HTTPS certificate despite the malicious intent. The site employed security‑related technologies including HSTS, HTTP/3, Cloudflare services, and Google Analytics. Gridinsoft assigned a trust score of 0 out of 100, reflecting an extremely low reputation. VirusTotal scanned the domain and reported four detections out of ninety‑four participating security vendors, reinforcing the malicious classification.

The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service. HTTP responses returned a 403 status code, suggesting the content was inaccessible at the time of testing. Defenders should immediately block the domain and its associated IP address in network and DNS filtering solutions, add the domain to internal blocklists, and monitor for any future re‑registration attempts or similar naming patterns that could be used to replicate this Microsoft‑focused impersonation campaign. Continuous observation of Cloudflare‑hosted domains with low trust scores and unusual page titles related to token sales is recommended to pre‑empt resurgence of this threat vector.