decentralizenets[.]pages[.]dev

Analysis of the domain decentralizenets.pages.dev shows that it was created on 21 February 2026 and is hosted behind Cloudflare’s infrastructure (AS13335) with the public address 188.114.97.3 located in the United States. The site presented the page title “Web Connect” and did not serve an SSL certificate, indicating HTTP‑only access. VirusTotal recorded a single positive detection out of 93 scanning engines, confirming that at least one vendor identified malicious behavior. The domain is listed on one external security blocklist and has been actively blocked by the PhishDestroy feed, reinforcing the malicious classification.

Current network probes indicate the host is taken offline, which is consistent with the “offline” status noted in the intelligence. The available evidence points to a generic phishing campaign, although the specific payload or credential‑stealing mechanism has not been captured. Defenders should continue to deny traffic to the IP address 188.114.97.3, add the domain to internal blocklists, and monitor for any re‑hosting attempts that may use the same Cloudflare account or similar page titles.

Because the site lacks TLS, any future resurrection would be easily detectable by TLS fingerprinting. The lack of an SSL certificate also prevents the use of certificate‑pinning defenses, but it simplifies detection for network‑level controls. No evidence of additional infrastructure such as command‑and‑control servers or malware distribution points was observed, leaving the phishing page as the primary indicator of compromise.