ecodus-docweb3[.]pages[.]dev

The domain ecodus-docweb3.pages.dev was registered on March 10, 2026 through Cloudflare, Inc. and is currently listed as offline. Technical inspection shows the site resolves to IP address 172.66.44.65, which belongs to AS13335 Cloudflare, Inc., locating the infrastructure in the United States. The TLS certificate presented is issued by Google Trust Services under the WE1 designation, and the service employs Cloudflare‑provided security features including HSTS and HTTP/3. An HTTP request to the root URL returns a 403 status code, indicating access is denied.

The page title returned by the server is "Suspected phishing site | Cloudflare," confirming that the host is flagged by the provider’s own protective mechanisms. Malware and URL reputation services have identified the domain as malicious: four of ninety‑four VirusTotal scanners reported it as malicious, and the site appears on three independent blocklists. Additional detection is evidenced by active blocking from PhishDestroy, MetaMask, and SEAL, all of which have catalogued the domain as a threat. Independent scoring from Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the high confidence of malicious intent.

The documented scam type is an investment scam, though the specific payload or targeted victim profile has not been disclosed. Defenders should ensure the domain is added to network‑level deny lists, update endpoint protection signatures to include the associated IP and certificate fingerprints, and continue monitoring for any re‑appearance on other hosting platforms. Because the site is already taken offline, immediate risk is reduced, but the infrastructure—particularly the Cloudflare‑hosted IP—may be reused for future campaigns, warranting ongoing vigilance.