testprojj[.]pages[.]dev

Analysis of testprojj.pages.dev indicates that the domain is currently offline but was previously identified as a credential‑phishing site. The domain was registered on March 22 2026 through Cloudflare, Inc., and its authoritative name servers are chin.ns.cloudflare.com and lochlan.ns.cloudflare.com. DNS resolution points to the IP address 188.114.97.3, which is hosted by Cloudflare in Canada. The SSL certificate presented is issued by Google Trust Services under the WE1 certificate authority, confirming that the site used a valid TLS certificate despite its malicious purpose. The page title observed during the brief live window was “Chain Lift – Decentralized Solutions,” suggesting an attempt to masquerade as a blockchain‑related service.

Automated scans detected the use of Three.js, Unpkg, cdnjs, LottieFiles, HTTP/3, and HTTP Strict Transport Security (HSTS), all delivered via Cloudflare’s CDN infrastructure. Gridinsoft assigned a trust score of 0 / 100, and eight of ninety‑four VirusTotal scanners flagged the domain as malicious, reinforcing the phishing classification. The domain appears on a single public blocklist and is actively blocked by the PhishDestroy feed. Evidence confirms the site’s primary objective was credential harvesting, as indicated by the “Credential Phishing” label in the intelligence.

No additional malicious payloads, redirects, or secondary infrastructure have been observed, leaving the extent of victim impact uncertain. Defenders should add 188.114.97.3 to network‑level block lists, enforce DNS filtering for testprojj.pages.dev, and monitor for any future re‑registration of the same second‑level domain. Continuous observation of Cloudflare‑hosted IP ranges for similar phishing patterns is recommended, as is periodic re‑scanning of the domain should it become active again. The combination of low trust scores, multiple vendor detections, and blocklist presence justifies an elevated risk rating and proactive mitigation.