yala-nft-dapp-main[.]pages[.]dev

Analysis of yala-nft-dapp-main.pages.dev indicates a newly registered domain (creation date 2026-02-21) that has been taken offline but exhibits multiple indicators of a brand‑impersonation campaign targeting Cloudflare. The site presented the browser title "Suspected phishing site | Cloudflare," a clear claim of legitimacy designed to lure victims. The domain resolves to IP address 172.66.44.76, which belongs to AS13335, owned by Cloudflare, Inc., and is geographically located in the United States. Hosting is provided through Cloudflare’s own infrastructure, as reflected by the presence of HSTS, HTTP/3, and Cloudflare‑specific technologies in the fingerprint. The SSL certificate is issued by Google Trust Services under the WE1 identifier, confirming a valid TLS layer despite the malicious intent.

HTTP responses returned a 403 status code, suggesting the page was blocked or removed at the time of inspection. The domain is registered through Cloudflare, Inc. and uses Cloudflare‑owned name servers hal.ns.cloudflare.com and cortney.ns.cloudflare.com, further obscuring attribution. Reputation services provide mixed signals: Scamadviser assigns a trust score of 41 out of 100, while Gridinsoft rates the domain at 0 out of 100, indicating a high likelihood of abuse. The domain appears on one known security blocklist and has been actively blocked by PhishDestroy, confirming its classification as a phishing vector. VirusTotal analysis recorded a single positive detection among 93 scanning engines, reinforcing the suspicion of malicious activity.

The listed scam type is an NFT scam, suggesting the operators may have attempted to lure users into fraudulent NFT transactions under the guise of Cloudflare branding. Uncertainty remains regarding the exact payload delivered to victims, as the site content was not captured before takedown. Defenders should continue to monitor the IP address 172.66.44.