compoundlabs[.]pages[.]dev

This domain, compoundlabs.pages.dev, is actively impersonating Compound, a known financial protocol, as indicated by its page title 'Compound Labs' and its classification as a brand impersonation scam. Registered on March 28, 2026, through Cloudflare, the domain resolves to the IP address 188.114.97.3, hosted in Canada under Cloudflare's infrastructure. The site employs HTTP/3 and HSTS, with nameservers arturo.ns.cloudflare.com and malavika.ns.cloudflare.com, suggesting reliance on Cloudflare's security and performance features to evade detection. Analysis reveals the domain is flagged on at least one security blocklist and has been detected by 2 of 94 security vendors on VirusTotal, indicating moderate but not universal recognition as malicious. The SSL certificate, issued by Google Trust Services (WE1), does not inherently validate legitimacy, as malicious actors frequently leverage trusted certificate authorities. The domain remains operational as of July 12, 2026, with an HTTP 200 status, confirming its active state. Defenders should prioritize this domain for blocking or monitoring, particularly in environments where Compound-related services are used. The exact nature of the scam—whether credential harvesting, fraudulent token distribution, or another scheme—remains unconfirmed due to the absence of deeper content analysis. Organizations should correlate this domain with other Compound-themed phishing infrastructure and assess potential exposure through email, messaging, or web traffic logs. Given its recent registration and active status, continued vigilance is warranted.