somnialaunchxz[.]pages[.]dev

On July 24, 2026, the domain somnialaunchxz.pages.dev was observed hosting a page titled “Blockchain Dapps”. The site was registered on February 21, 2026 through Cloudflare, Inc., and the DNS resolves to the IP address 104.21.48.1, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. No TLS certificate was presented, indicating the site operated over plain HTTP. VirusTotal scanned the domain and three of ninety‑three security vendors reported it as malicious, consistent with its classification as a crypto‑related phishing campaign.

The domain appears on a single public blocklist and has been added to the PhishDestroy blocklist, confirming that at least one external sinkhole has taken action. The page title suggests an attempt to lure victims interested in blockchain decentralized applications, but no additional content analysis is available because the service is currently offline. The evidence points to a short‑lived infrastructure that was likely deployed to harvest cryptocurrency credentials or lure users into fraudulent transactions. The limited detection count and single blocklist entry imply that the campaign had minimal exposure before being taken down.

However, the lack of a TLS certificate and the use of a generic Cloudflare‑hosted subdomain reduce the technical barriers for rapid redeployment, meaning that similar domains could appear in the future. Defenders should flag any resolution to 104.21.48.1 that originates from the somnialaunchxz.pages.dev subdomain, monitor Cloudflare‑hosted DNS entries for new domains created after February 2026 with similar naming patterns, and incorporate the three vendor detections from VirusTotal into their threat‑intel feeds. Blocking the IP at the network perimeter may disrupt any residual activity, and adding the domain to local blocklists will prevent accidental user access.