reflex-7gd[.]pages[.]dev

Analysis indicates that the domain reflex-7gd.pages.dev was registered on 31 Mar 2026 and is hosted behind Cloudflare’s network (IP 172.66.47.196, location CA). The site serves an HTTP 200 response and presents the page title “Reflex | Stake tokens, earn SOL”. The SSL certificate is issued by Let’s Encrypt (identifier E8). Nameservers lilith.ns.cloudflare.com and randall.ns.cloudflare.com confirm the use of Cloudflare’s DNS infrastructure. The page is classified as a brand‑impersonation campaign targeting the “Fake Staking” brand, as reflected in the page title and the listed brand target. The domain has been added to at least one security blocklist and is currently blocked by PhishDestroy. Independent reputation scoring (Gridinsoft) rates the domain 0 / 100, indicating a lack of trust. The threat is marked as active and under investigation. Open questions remain regarding the exact content and functionality of the site, as no visual analysis is available. Defenders should treat the domain as malicious until further verification, enforce DNS‑ or proxy‑level blocking, monitor for any associated C2 traffic, and consider adding the IP address 172.66.47.196 to network‑level deny lists. Ongoing observation of Cloudflare‑associated subdomains and any future detections by additional scanners is recommended.