polkadotupdate[.]pages[.]dev

Analysis of polkadotupdate.pages.dev indicates active credential phishing infrastructure targeting users through a Cloudflare-hosted domain. The domain, registered on October 15, 2025, resolves to IP 172.66.47.175 (AS13335, Cloudflare, Inc.) and employs HTTP/3 and HSTS technologies. Current HTTP status is 522 (Connection timed out), though this may reflect temporary takedown or evasion tactics rather than permanent inactivity. The page title, 'polkadotupdate.pages.dev | 522: Connection timed out,' provides no explicit brand confirmation, but the scam type is classified as credential phishing based on available intelligence. Google Safe Browsing has flagged the domain under 'SOCIAL_ENGINEERING,' and 11 of 93 security vendors on VirusTotal detect it as malicious. The domain appears on one security blocklist, and its Gridinsoft trust score is 0/100. SSL certificate is issued by Google Trust Services (WE1), and nameservers are kay.ns.cloudflare.com and matteo.ns.cloudflare.com. No specific phishing kit or targeted brand is confirmed in the available data, though the domain name suggests potential association with Polkadot or related services. Defenders should treat this domain as high-risk and block it at the DNS or proxy level. Monitor for changes in HTTP status or page content, as threat actors may restore functionality. If internal logs show user connections to this domain, initiate credential reset procedures and review endpoint telemetry for signs of compromise. Further analysis of network traffic or endpoint artifacts may clarify the exact phishing mechanism, but current evidence supports immediate containment.