explore-defilama-web3-free[.]pages[.]dev

Analysis confirms that explore-defilama-web3-free.pages.dev was registered on 21 February 2026 through Cloudflare, Inc. The domain resolves to 172.66.44.232, an address owned by AS13335 Cloudflare in the United States. The TLS certificate is issued by Google Trust Services under the WE1 profile, indicating a valid HTTPS endpoint, yet the web server returns HTTP 403, which is typical for a blocked or taken‑down page. The page title returned by the server is “Suspected phishing site | Cloudflare”, and the listed scam type is a crypto scam, specifically a crypto drainer. Reputation services show a Gridinsoft trust score of 0 / 100, and nine of ninety‑five VirusTotal scanners have flagged the domain as malicious.

Google Safe Browsing classifies it as social engineering, and the domain appears on one active security blocklist maintained by PhishDestroy. Detected technologies include HSTS, Cloudflare protection, and HTTP/3, and the authoritative nameservers are jamie.ns.cloudflare.com and coen.ns.cloudflare.com. The available evidence points to a deliberately crafted infrastructure that leverages Cloudflare’s CDN and SSL capabilities to lend legitimacy while delivering a crypto‑draining payload. Because the site is currently offline, live content cannot be inspected, leaving the exact phishing vector and any embedded wallets or contract addresses unknown.

Defenders should treat the domain as hostile: add it to DNS blocklists, enforce outbound filtering to prevent connections to the IP address, and monitor for other subdomains or newly registered *.pages.dev domains that use similar naming patterns. Continuous re‑query of VirusTotal and Google Safe Browsing is advised to capture any future re‑activations. Coordination with Cloudflare’s abuse team may expedite takedown, and internal threat‑intel feeds should be updated to reflect the crypto‑drainer classification linked to this domain.