app-multidappserverid[.]pages[.]dev

On 24 July 2026 the domain app-multidappserverid.pages.dev was observed to be hosted on Cloudflare’s infrastructure and to serve a page titled “Suspected phishing site | Cloudflare”. The domain was created on 21 February 2026 and is registered through Cloudflare, Inc. DNS resolution points to the IP address 172.66.46.225, which belongs to AS13335 Cloudflare, Inc. in the United States. HTTPS is terminated by a Google Trust Services certificate (WE1) and the site advertises HSTS and HTTP/3 support, indicating a modern Cloudflare edge configuration. An HTTP request to the origin returns a 403 status code, and the site has been taken offline at the time of analysis. Reputation signals are uniformly negative.

Gridinsoft assigns a trust score of 0 out of 100. The domain appears on five external blocklists and is actively blocked by PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura. VirusTotal scans show three of ninety‑three security vendors flagging the domain, reinforcing the classification as malicious. The listed scam type is “Investment Scam”, although no specific target brand is identified in the available metadata. Defenders should treat any network traffic to or from 172.66.46.225 associated with this domain as hostile.

Blocking the domain at the DNS or proxy level, and adding the IP address to firewall deny lists, will prevent accidental user exposure. Continuous monitoring of Cloudflare‑hosted assets is advised because the underlying infrastructure can be reused for future campaigns. Because the page content has not been captured, visual or functional analysis remains unavailable, and the precise lure used in the investment scam cannot be confirmed. Analysts should also watch for newly registered subdomains under the same registrar that resolve to Cloudflare IP ranges, as they may indicate a shift in the attacker’s infrastructure.