migration-opsec[.]pages[.]dev

The domain migration-opsec.pages.dev was registered on 21 February 2026 through Cloudflare, Inc. and resolves to the Cloudflare‑owned address 172.66.44.214 located in the United States (AS13335). The site presents a single page with the title “OpSec” and serves an SSL certificate issued by Google Trust Services under the WE1 designation, enforcing HSTS and HTTP/3. Analysis by multiple public feeds shows the domain is listed on three security blocklists and is explicitly blocked by PhishDestroy, ScamSniffer, and Enkrypt. VirusTotal has recorded twelve positive detections out of ninety‑three scanners, and Google Safe Browsing categorises the URL as social engineering.

Trust‑rating services assign very low scores: Gridinsoft reports a 0 / 100 rating and Scamadviser a score of 11 / 100. The HTTP response returned a 403 status code, indicating the resource is currently inaccessible; the operational status is reported as offline. The threat classification supplied by the intelligence feed identifies the campaign as wallet/seed phishing, targeting cryptocurrency credentials.

While the page content has not been publicly disclosed, the convergence of blocklist listings, multiple vendor detections, and a low trust score strongly supports the malicious designation. Defenders should add migration-opsec.pages.dev and its resolving IP 172.66.44.214 to deny‑list rules, monitor Cloudflare name‑server changes for re‑hosting, and continue to reference the domain in threat‑intel feeds. Ongoing observation is advised in case the site is re‑activated or used as a redirect in future campaigns.