spport-exchange-dydeex[.]pages[.]dev

Analysis of spport-exchange-dydeex.pages.dev indicates a high‑risk phishing infrastructure that has been taken offline as of the report date. The domain was registered on February 21, 2026 and resolves to IP address 188.114.96.3, which is owned by AS13335 Cloudflare, Inc. in the United States. Hosting is provided through Cloudflare with HSTS and HTTP/3 enabled, and the TLS certificate is issued by Google Trust Services under the WE1 label, confirming a legitimate certificate chain but not validating the content.

The site returns an HTTP 403 status and displays the page title "Suspected phishing site | Cloudflare," suggesting that Cloudflare’s protection service has intercepted traffic. Google Safe Browsing classifies the URL as social engineering, and Scamadviser assigns a trust score of 1/100 while Gridinsoft rates it 0/100, reflecting extreme suspicion. The domain appears on one security blocklist and is actively blocked by PhishDestroy; VirusTotal records ten detections out of ninety‑three scanners, further corroborating malicious intent.

The listed scam type is "Fake Exchange," implying the site was intended to impersonate an exchange platform, though no specific brand is disclosed in the available data. Defenders should immediately add the domain and its associated IP to deny‑lists and email filtering rules, monitor DNS queries for re‑registration attempts, and consider broader blocking of the Cloudflare nameservers stephane.ns.cloudflare.com and otto.ns.cloudflare.com if they suspect abuse. Continuous threat‑intel feeds should be queried for any resurgence of the domain or related subdomains, and incident response teams should verify that no credential harvesting occurred against internal accounts during the brief online window.