testfixpanel[.]pages[.]dev

The domain testfixpanel.pages.dev was created on March 23, 2026 and is registered through Cloudflare, Inc. It resolves to the IP address 172.66.47.4, which is associated with Cloudflare infrastructure located in Canada. The site serves content over HTTPS using a certificate issued by Google Trust Services and enforces HTTP Strict Transport Security. HTTP/3 is enabled, and the page title returned by the server is "Web 3 - Web3 crypto fix". Detected technologies include Unpkg and Smartsupp, both of which are commonly leveraged for script delivery and live‑chat widgets. The domain is currently classified as a crypto‑focused phishing operation and appears on two security blocklists; it has been blocked by PhishDestroy and ScamSniffer. VirusTotal analysis shows four of ninety‑four scanners flagging the domain, and Gridinsoft assigns a trust score of 0 out of 100, reinforcing the high‑risk assessment. Infrastructure signals—such as the recent registration date, exclusive use of Cloudflare DNS (jarred.ns.cloudflare.com, sky.ns.cloudflare.com), and the presence of HSTS—are consistent with fast‑flux or throwaway domains used in phishing campaigns. While the page title suggests a crypto‑repair theme, no additional content has been examined, leaving the exact lure and any credential‑collection mechanisms unverified. Defenders should immediately block or sinkhole testfixpanel.pages.dev, monitor DNS queries for the associated Cloudflare nameservers, and enforce email filtering rules that flag messages referencing "Web3 crypto fix" or similar phrasing. Ongoing telemetry should be collected to detect any subsequent payload delivery or command‑and‑control activity linked to the observed IP address.