dapp-refixer[.]pages[.]dev

Analysis of dapp-refixer.pages.dev shows a recently created domain (registered 21 Feb 2026) hosted on Cloudflare’s network. The registrar entry lists Cloudflare, Inc. as the registrar and the authoritative nameservers are tosana.ns.cloudflare.com and jo.ns.cloudflare.com. DNS resolution points to IP 172.66.45.24, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presented a TLS certificate issued by Google Trust Services under the WE1 label, confirming the use of a valid HTTPS endpoint. An HTTP request returned a 403 response, and the page title reported by the server is “Suspected phishing site | Cloudflare”, indicating that the content is either blocked by Cloudflare’s abuse mitigation or deliberately presented as a warning page.

Threat intelligence shows the domain is classified as an investment‑related phishing campaign. VirusTotal recorded a single positive detection out of 95 scanners, while Gridinsoft assigned a trust score of 0 / 100, and Scamadviser reported a score of 41 / 100. The domain is listed on one security blocklist and has been actively blocked by the PhishDestroy service. Detected technologies include HTTP/3, HSTS enforcement, and Cloudflare’s edge services.

The available evidence confirms the infrastructure, hosting, and some reputation indicators, but no payload samples or page content have been captured because the site is currently offline. Consequently, the precise phishing lure, targeted victims, and any associated command‑and‑control infrastructure remain unknown. Defenders should continue to block the domain and its resolved IP address at perimeter defenses, add the domain to URL filtering and phishing‑prevention lists, and monitor for any re‑registration attempts or related sub‑domains under the same Cloudflare account. Ongoing observation of Cloudflare‑owned IP ranges for similar 403 responses and updates from threat‑intel feeds is recommended to detect potential re‑deployment of the campaign.