cloud-opn-sea[.]pages[.]dev

The domain cloud-opn-sea.pages.dev was registered on February 21, 2026 and is currently taken offline, returning HTTP 403 responses. DNS resolution points to IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc., located in the United States. The domain is served through Cloudflare’s edge network and employs modern transport features, including HTTP/3 and HSTS. SSL termination is provided by a Google Trust Services certificate (WE1).

Nameserver delegation uses brad.ns.cloudflare.com and melody.ns.cloudflare.com, confirming Cloudflare as the registrar. The site’s title, "Suspected phishing site | Cloudflare," indicates that the page itself declares a phishing suspicion, but no further content has been harvested because the host is offline. Threat intelligence classifies the activity as credential phishing, and Google Safe Browsing has flagged the domain for social engineering. VirusTotal analysis shows that 10 of 93 security vendors have raised detections, reinforcing the malicious assessment.

Additional security controls have already taken action: the domain is listed on at least one public blocklist, has been blocked by PhishDestroy, and receives a Gridinsoft trust score of 0 out of 100. While the precise target brand or credential collection vector remains undisclosed, the convergence of Cloudflare‑hosted infrastructure, low trust score, and multiple vendor detections provides a high‑confidence indication of malicious intent. Defensive teams should add the domain to inbound and outbound filtering rules, update internal threat‑intel feeds, and monitor DNS queries for the associated IP and nameservers. Continuous re‑evaluation is advised in case the site is re‑activated or new artifacts emerge.