claimadmin-a17y11id-infoshielderc[.]pages[.]dev

Analysis of claimadmin-a17y11id-infoshielderc.pages.dev shows that the domain was registered through Cloudflare on 16 Nov 2025 and immediately placed behind Cloudflare’s edge network (AS13335, United States). The TLS certificate is issued by Google Trust Services (WE1) and the site enforces HSTS while supporting HTTP/3. DNS resolution points to 188.114.96.3, a Cloudflare‑owned address, confirming that the infrastructure is fully hosted on Cloudflare’s platform. The HTTP response returned a 403 status code and the page title is “Suspected phishing site | Cloudflare”, indicating that Cloudflare has flagged the content as malicious.

Reputation services rate the domain extremely low: Gridinsoft assigns a 0 / 100 score, Scamadviser a 1 / 100 score, and 15 of 95 VirusTotal scanners have flagged it as malicious. The domain appears on a single security blocklist and is listed by PhishDestroy as taken offline. The identified scam type is “Crypto Scam”, specifically a crypto drainer, aligning with the threat classification provided. Defenders should treat any traffic to this host as hostile, enforce outbound filtering to block connections to 188.114.96.3, and consider adding the domain to internal deny lists.

Monitoring of Cloudflare‑hosted subdomains for similar patterns is advised, as the same registrar and infrastructure are frequently reused by threat actors. Because the site currently returns 403 and is reported offline, active exploitation appears halted, but the underlying infrastructure remains under the control of the attacker and could be re‑activated. Continuous vigilance, DNS sinkholing, and coordination with Cloudflare abuse channels are recommended to prevent re‑deployment.