sealtokens[.]pages[.]dev

On 2026-07-29, sealtokens.pages.dev was examined after its appearance on multiple security blocklists. DNS resolution shows the domain mapping to the IPv4 address 188.114.97.3. The registrar is listed as Cloudflare, Inc., and the authoritative name servers are carmelo.ns.cloudflare.com and kristin.ns.cloudflare.com, indicating that the domain is hosted on Cloudflare’s infrastructure. The domain is present on two public blocklists and is actively blocked by the PhishDestroy and Enkrypt filtering services, confirming that threat‑intelligence feeds regard it as malicious.

VirusTotal records show that the domain has been submitted to 91 scanning engines; none of those engines have generated a detection at the time of analysis. The lack of a detection does not imply safety, and the domain remains classified as a generic phishing site. No SSL/TLS certificate details, HTTP status codes, page title, or additional content metadata are available in the current intelligence set, leaving the surface‑level characteristics of the site unverified. The combination of active blocklist listings, Cloudflare registration, and the observed IP address suggests a deliberately provisioned infrastructure designed to host phishing content.

Defenders should continue to block the domain at perimeter and DNS layers, monitor outbound connections to 188.114.97.3, and add the domain to internal blocklists if not already present. Security teams should also query threat‑intel platforms for any future appearances of the IP address in other campaigns, and consider sinkholing the domain where policy permits. Ongoing collection of page‑level indicators, such as HTML title and any observed credential‑harvesting forms, is recommended to refine detection rules and to assess whether the site evolves beyond the current generic phishing profile.