corvuslatimerrewardbonus[.]pages[.]dev

Analysis as of July 25 2026 indicates that the domain corvuslatimerrewardbonus.pages.dev was registered on March 10 2026 through Cloudflare, Inc. The domain resolves to IP 188.114.96.3, which belongs to AS13335 owned by Cloudflare, Inc. The host is located in the United States. DNS resolution uses Cloudflare nameservers lex.ns.cloudflare.com and maisie.ns.cloudflare.com. The site served an SSL certificate identified as “E7”, and HTTP responses included HSTS and HTTP/3 headers, confirming use of Cloudflare edge services. The only visible artifact from the page is the title “DebbugDappNode”. Intelligence classifies the content as a “Fake Airdrop” scam, a common technique that lures victims with promises of cryptocurrency rewards.

The domain has been flagged by PhishDestroy and appears on a single public security blocklist. VirusTotal scans show that 2 of 94 scanning engines have flagged the domain as malicious, reinforcing the suspicion. The site is currently offline, which limits further in‑depth payload analysis. No additional artifacts such as page HTML, JavaScript, or credential‑stealing forms have been captured, so the exact phishing workflow remains unknown. The presence of Cloudflare’s security features (HSTS, HTTP/3) does not mitigate the malicious intent because they are commonly leveraged by attackers to hide behind reputable infrastructure.

Defenders should continue to block the domain at network perimeter and DNS resolvers. Monitoring for any re‑appearance of the subdomain on Cloudflare’s pages.dev namespace is advisable, as attackers frequently recycle similar URLs. Threat hunting should include correlation of outbound connections to 188.114.96.3 and inspection of logs for attempts to resolve the domain after the offline date. Inclusion of the domain in internal blocklists and sharing of the indicator with industry peers will reduce exposure.