lastaml2[.]pages[.]dev

The domain lastaml2.pages.dev was registered on March 23, 2026 through Cloudflare, Inc., and resolves to the Cloudflare‑owned address 188.114.96.3 located in Canada. Infrastructure analysis shows the site is protected by HSTS, serves HTTP/3, and presents a Google Trust Services / WE1 SSL certificate, indicating a legitimate‑looking TLS layer. The HTTP response returned a 403 status, and the domain is currently taken offline. Threat intelligence flags the domain as a brand‑impersonation campaign targeting the cryptocurrency brand Blast, with the scam classified as an investment scam.

The page title observed during the brief scan reads "AML Check - The full-fledged crypto compliance solution," which suggests an attempt to lure users with a compliance‑oriented façade. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on three separate security blocklists. It has been actively blocked by PhishDestroy, MetaMask, and SEAL, and one of ninety‑four VirusTotal scanners flagged it as malicious. No additional content analysis is available because the site is offline, leaving the exact phishing tactics and payload unknown.

Defenders should immediately add lastaml2.pages.dev to network‑level deny lists and ensure that any DNS filtering solutions block the domain and its associated IP range. Continuous monitoring of Cloudflare‑registered domains resembling the pattern "*pages.dev" for similar brand‑impersonation cues is advised, as is reviewing outbound traffic for connections to the 188.114.96.3 address. Updating endpoint protection with the latest threat feed that includes this indicator will help prevent potential credential or financial compromise should the site reactivate.