dsadsa[.]pages[.]dev

Analysis of dsadsa.pages.dev, observed on 23 July 2026, shows an active credential‑phishing site that presents a page titled “RTFKT CLAIM”. The domain was registered on 19 February 2023 through Cloudflare, Inc., and is served from Cloudflare’s network, located in Canada. DNS resolves to 188.114.96.3, and the site presents a Google Trust Services / WE1 SSL certificate, indicating a valid TLS chain. HTTP responses return status code 403, suggesting the front‑end may be restricting access or employing challenge mechanisms. The page is built with Nicepage, unpkg, jQuery, cdnjs, and is delivered over HTTP/3, all typical of a modern web stack hosted behind Cloudflare’s edge.

Security telemetry flags the domain as high‑risk. Gridinsoft assigns a trust score of 0 / 100. VirusTotal reports 7 of 91 scanners flagging the domain, and the domain appears on at least one public blocklist, currently blocked by PhishDestroy. The site has been catalogued as a generic phishing operation targeting credentials, specifically a “RTFKT Claim” lure, though the exact phishing kit or content has not been captured. No additional intelligence such as OTX references or Safe Browsing alerts is presently available.

Defenders should block DNS resolution to dsadsa.pages.dev at the network perimeter and add the IP 188.114.96.3 to deny lists, recognizing that Cloudflare may host multiple unrelated sites on the same address. Monitoring of outbound traffic for attempts to post credentials to this domain is advisable. Given the presence of a valid TLS certificate, client‑side alerts based on certificate issuer alone will be ineffective; instead, employ URL‑reputation services that incorporate the observed blocklist entry and VirusTotal detections. Continuous re‑scanning of the domain is recommended, as the underlying content could change while the infrastructure remains static.