Is soar-899.pages.dev a Credential Phishing Site?

Analysis of the domain soar-899.pages.dev shows a recent registration (April 29 2026) through Cloudflare, Inc. The domain resolves to the Cloudflare edge address 172.66.44.133, located in Canada, and uses Cloudflare’s DNS infrastructure (lou.ns.cloudflare.com, paris.ns.cloudflare.com). TLS is provided by a Let’s Encrypt certificate (E8) and the site enforces HSTS and HTTP/3, indicating a modern web stack. An HTTP GET returns status 200 and the page title is “Soar.meme — Launch. Meme. Soar.”. The domain is listed on a single security blocklist (PhishDestroy) and receives a Gridinsoft trust score of 0 / 100, reinforcing the suspicion of malicious intent. The classified scam type is credential phishing, suggesting the site is likely used to harvest login credentials. No public malware detections are available, but the absence of detections does not confirm safety. Concrete evidence is limited to the infrastructure details and blocklist listing; the actual content of the page has not been examined. Defenders should treat the domain as hostile, block network traffic to the IP address and hostname, and monitor for any attempts to deliver credential‑stealing payloads. Ongoing observation is advised to capture any changes in hosting, certificate renewal, or additional threat‑intel indicators.