ops-sea-loginx-cloud[.]pages[.]dev

ops-sea-loginx-cloud.pages.dev is observed as a credential‑phishing infrastructure that was taken offline prior to the report date of 25 July 2026. The domain was registered on 21 February 2026 through Cloudflare, Inc. and resolves to the Cloudflare edge address 172.66.44.113, which belongs to AS13335 Cloudflare, Inc. in the United States. The site presents an HTTP 403 status and serves a certificate issued by Google Trust Services under the “WE1” designation, indicating a valid TLS handshake. The page title returned by the server is “Suspected phishing site | Cloudflare”, and the service employs HSTS, HTTP/3, and other Cloudflare‑provided technologies. Detection intelligence shows that the domain appears on one external security blocklist and is actively blocked by PhishDestroy.

Google Safe Browsing classifies the URL as a social‑engineering threat. VirusTotal scans have recorded 14 positive detections out of 93 security vendors, reinforcing the malicious assessment. Additional reputation data includes a Gridinsoft trust score of 0 / 100, reflecting a highly untrusted status. Current DNS records list the authoritative nameservers “susan.ns.cloudflare.com” and “henry.ns.cloudflare.com”.

No further content analysis is available beyond the generic page title; the exact phishing payload or targeted brand has not been disclosed. Consequently, while the site is offline, the underlying Cloudflare infrastructure and the associated IP address remain viable for future reuse by the threat actors. Defenders should add ops‑sea‑loginx‑cloud.pages.dev to block lists, enforce DNS‑sinkhole or firewall rules for the IP 172.66.44.113, and monitor for new subdomains under the same Cloudflare account. Continuous VirusTotal and Google Safe Browsing queries are recommended to capture any re‑appearance, and security appliances should be updated to reflect the 14 vendor detections associated with this domain.