ens-web-cld-opseas-loginz[.]pages[.]dev

The domain ens-web-cld-opseas-loginz.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and uses the nameservers susan.ns.cloudflare.com and henry.ns.cloudflare.com. DNS resolution points to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presents a TLS certificate issued by Google Trust Services under the identifier WE1, indicating that the certificate chain is valid but that the underlying domain is not owned by Google. The HTTP response returned a 403 status code and the page title reported by the server is "Suspected phishing site | Cloudflare," confirming that the host is being flagged by Cloudflare’s own protective mechanisms. Technical headers reveal that the service enforces HSTS, operates behind Cloudflare’s edge, and supports HTTP/3, all of which are typical of legitimate Cloudflare‑protected sites and may be leveraged to lend credibility to the malicious infrastructure.

Detection telemetry shows that 11 of 93 antivirus and URL‑reputation engines on VirusTotal flagged the domain, while Google Safe Browsing classifies it as a social‑engineering threat. Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on at least one external blocklist. PhishDestroy has also taken the domain offline, which aligns with the current offline status reported. The identified scam type is brand impersonation targeting Google, but the specific phishing payload or page content has not been disclosed beyond the generic title.

From the available evidence, defenders can conclude that the domain was actively used to impersonate Google and was recognized by multiple security vendors as malicious. The combination of a valid Google‑issued TLS certificate, Cloudflare infrastructure, and a low trust score suggests an attempt to exploit trust in both the certificate authority and the hosting provider.