dapp-api-cp0[.]pages[.]dev

Analysis of dapp-api-cp0.pages.dev indicates that the domain is being used for an investment‑type phishing operation and has been taken offline. The domain was registered on February 21, 2026 through Cloudflare, Inc., and resolves to the Cloudflare‑owned address 172.66.44.104, which is located in the United States and belongs to ASN 13335 (Cloudflare, Inc.). The site returns an HTTP 403 status code and the page title presented by the server is "Suspected phishing site | Cloudflare," confirming that the hosting provider has flagged the content as malicious. The domain appears on a single security blocklist, specifically PhishDestroy, and its presence has been reported by at least one blocklist source.

Reputation services show a Gridinsoft trust score of 0 out of 100 and a Scamadviser score of 21 out of 100, both indicating a lack of legitimacy. The SSL certificate is issued by Google Trust Services under the WE1 framework, which is typical for Cloudflare‑proxied sites and does not mitigate the phishing risk. Detected infrastructure components include HTTP/3, HSTS, and Cloudflare’s edge services. VirusTotal analysis shows that 13 of 95 scanning engines flagged the domain as malicious, providing independent corroboration of the phishing classification.

Nameservers are listed as kenneth.ns.cloudflare.com and priscilla.ns.cloudflare.com, further confirming Cloudflare’s involvement. While the exact phishing landing page content has not been captured, the combination of a suspicious page title, blocklist inclusion, low trust scores, and multiple vendor detections provides strong evidence of an investment scam. Defenders should continue to block the domain at network perimeters, update web filtering and DNS security policies, and monitor for any re‑registration attempts. Incident response teams should also consider correlating traffic to the IP address 172.66.44.104 with other observed malicious activity to identify potential related campaigns.