scrool-23x[.]pages[.]dev

The domain scrool-23x.pages.dev is currently classified as a generic phishing threat with an elevated risk rating and remains active as of the report date, July 29, 2026. Infrastructure analysis shows the domain is hosted on Cloudflare Pages, a service frequently leveraged for rapid content deployment, and resolves to the IP address 188.114.96.3. Registration records indicate the domain was created on November 01, 2024, suggesting a relatively recent appearance in the threat landscape.

Reputation data confirms the domain is listed on four external security blocklists and has been explicitly blocked by multiple anti‑phishing solutions, including PhishDestroy, MetaMask, ScamSniffer, and SEAL. VirusTotal scans reveal that four out of ninety‑one participating security vendors have flagged the domain, providing independent corroboration of malicious intent. While the specific phishing payload or targeted brand has not been publicly disclosed, the convergence of blocklist entries, vendor detections, and hosting characteristics points to a purposeful abuse of the domain for credential‑harvesting or similar fraudulent activity.

Defenders should continue to block the domain at network perimeters, update endpoint and browser protection policies, and monitor for any outbound connections to 188.114.96.3. Incident response teams should also consider adding the domain to internal allow‑list exclusions for legitimate traffic only after thorough validation, and conduct threat‑intel enrichment to determine whether related subdomains or associated IPs are being leveraged in broader campaigns.