algebra-frontend[.]pages[.]dev

Analysis of the domain algebra-frontend.pages.dev indicates an active high-risk brand impersonation campaign targeting Bitcoin-related services. The domain, registered on March 28, 2026, through Cloudflare, Inc., resolves to the IP address 188.114.97.3, which is associated with Cloudflare's infrastructure in Canada. The page title, 'Glyph Exchange V4 | Bitcoin-powered DEX on Core DAO,' suggests an attempt to mimic a decentralized exchange (DEX) platform, aligning with the identified scam type of brand impersonation targeting Bitcoin. Infrastructure analysis reveals the use of Cloudflare nameservers (pete.ns.cloudflare.com and zara.ns.cloudflare.com) and technologies including HSTS, Cloudflare Browser Insights, and HTTP/3. The SSL certificate is issued by Google Trust Services (WE1), and the domain currently returns an HTTP 200 status, confirming its operational status. As of July 12, 2026, the domain appears on one security blocklist and is flagged by 3 of 94 security vendors in VirusTotal, though the specific detection rules or signatures are not detailed in available intelligence. The Gridinsoft trust score of 0/100 further corroborates the domain's malicious classification. While the exact content and functionality of the site remain unanalyzed, the combination of Bitcoin brand impersonation, Cloudflare-hosted infrastructure, and low detection counts suggests a targeted phishing operation. Defenders are advised to block the domain at the DNS or network level, monitor for related subdomains or IPs within Cloudflare's ranges, and alert users to the presence of this impersonation campaign. Continued observation of detection trends and registrar actions is recommended to assess the campaign's persistence or evolution.