polkastarter-3fw[.]pages[.]dev

polkastarter-3fw.pages.dev was observed hosting a page titled “Suspected phishing site | Cloudflare”. The domain was registered on February 21, 2026 via Cloudflare, Inc., and resolves to the Cloudflare edge address 172.66.44.243, located in the United States under AS13335 (Cloudflare, Inc.). No TLS certificate was presented, indicating the site was served without HTTPS. Automated scans on VirusTotal returned 7 detections out of 93 security vendors, and the domain appears on four independent security blocklists.

It has been actively blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura. The site’s risk level was assessed as elevated, and the current operational status is offline, suggesting that the hosting provider or the blocking services have taken the site down. Evidence confirms that the domain was used for a generic phishing campaign, although the specific target brand or lure was not disclosed in the available data.

The lack of an SSL certificate and the reliance on Cloudflare’s shared hosting infrastructure are typical of short‑lived phishing infrastructure. Defenders should continue to deny any network traffic to the IP 172.66.44.243, add the domain to local blocklists, and monitor for re‑registration or similar sub‑domains under the same registrar. Ongoing threat‑intel feeds should be consulted for any resurgence, and any future sightings should be correlated with the observed blocklist signatures.