ethereumclassic[.]pages[.]dev

Analysis of ethereumclassic.pages.dev shows a high‑risk brand‑impersonation campaign targeting the Ethereum brand. The domain was registered through Cloudflare, Inc. on February 21, 2026 and resolves to the Cloudflare‑owned address 172.66.47.197, ASN 13335, located in the United States. The site presents the page title "Suspected phishing site | Cloudflare" and serves content over HTTPS with a Google Trust Services / WE1 certificate, HSTS, and HTTP/3 enabled. Google Safe Browsing flags the domain for social engineering, and VirusTotal records 12 of 93 security vendors labeling the domain as malicious.

Gridinsoft assigns a trust score of 0 / 100, indicating an extremely low reputation. The domain appears on a single security blocklist and has been taken offline, with PhishDestroy confirming the takedown. Nameservers val.ns.cloudflare.com and dylan.ns.cloudflare.com confirm the Cloudflare hosting environment. While the HTTP response code is 403, the presence of a Cloudflare‑generated error page does not mitigate the underlying impersonation risk.

Defenders should immediately block the domain and its associated IP address, add the resolver to threat‑intel feeds, and monitor for any resurgence of the same infrastructure. Further investigation should focus on any related subdomains or future registrations that reuse the same nameserver set, as the Cloudflare hosting pattern suggests a reusable malicious toolkit. Continuous monitoring of Google Safe Browsing and VirusTotal updates is recommended to capture any new detections.