wct-779[.]pages[.]dev

The domain wct-779.pages.dev was registered on March 03, 2026 through Cloudflare, Inc. and resolves to the Cloudflare‑owned address 172.66.45.9 (AS13335, United States). The site presents a page titled "Suspected phishing site | Cloudflare" and returns an HTTP 403 status code, indicating the content is currently inaccessible. Google Safe Browsing classifies the host as a social engineering threat, and VirusTotal reports that 7 of 94 scanned security vendors have flagged the domain as malicious.

Independent blocklists confirm the domain appears on three separate security blocklists, and it is actively blocked by PhishDestroy, MetaMask, and SEAL. The SSL certificate is issued by Let’s Encrypt (E7) and the site enforces HSTS while supporting HTTP/3, both typical of Cloudflare‑hosted services. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the low credibility of the infrastructure.

The technical footprint, combined with the explicit scam type of credential phishing, suggests the domain was used to harvest login credentials before being taken offline. While the exact payload and targeted brands remain undisclosed, defenders should continue to block the domain at network perimeters, monitor for any re‑registration attempts, and update endpoint protection signatures to include the observed indicators of compromise. Ongoing observation of the IP address and associated Cloudflare nameservers (sandra.ns.cloudflare.com, walt.ns.cloudflare.com) is recommended to detect potential reuse in future phishing campaigns.