daps-chain[.]pages[.]dev

Analysis of daps-chain.pages.dev shows a credential‑phishing infrastructure that was taken offline prior to the report date of July 24, 2026. The domain was created on February 21, 2026 and registered through Cloudflare, Inc., using the authoritative nameservers carrera.ns.cloudflare.com and yisroel.ns.cloudflare.com. DNS resolution points to IP address 172.66.47.153, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site served over HTTPS with a Google Trust Services / WE1 certificate and employed security headers such as HSTS, as well as Cloudflare‑specific technologies including HTTP/3. An HTTP request returned a 403 status code and the page title displayed "Suspected phishing site | Cloudflare," indicating that the content was flagged by Cloudflare’s own anti‑phishing mechanisms.

Threat intelligence sources list the domain on one security blocklist and it is explicitly blocked by PhishDestroy. VirusTotal scans recorded 14 detections out of 93 security vendors, reinforcing the malicious classification. Reputation services assign extremely low trust scores: Scamadviser rates the domain 1 / 100 and Gridinsoft rates it 0 / 100, both consistent with a high‑confidence phishing judgment. The overall risk level is elevated, although the current status is offline, suggesting that the hosting was terminated or the content removed.

Defenders should continue to block the domain at network perimeter devices, DNS filters, and endpoint protection solutions, using the observed IP address and associated Cloudflare nameservers as additional indicators. Monitoring for new domains registered through Cloudflare that exhibit similar naming patterns or resolve to the same IP range may help detect re‑use of this infrastructure. Given the short lifespan of the domain, rapid detection and automated blocklist updates are advisable to mitigate exposure to credential‑phishing campaigns that could leverage comparable hosting setups in the future.