quantumsell[.]pages[.]dev

Analysis of quantumsell.pages.dev, created on February 21, 2026 and registered through Cloudflare, Inc., shows multiple indicators of malicious activity targeting the Ethereum brand. The site resolves to the IP address 172.66.47.167, which belongs to AS13335 Cloudflare, Inc., located in the United States. An SSL certificate issued by Google Trust Services (WE1) is present, and the server advertises HSTS, Cloudflare protection, and HTTP/3, suggesting a modern CDN configuration. The page title returned by the server is "Quantum Sell - Advanced Cryptocurrency Exchange," and the HTTP response code is 403, indicating that the site is currently inaccessible.

Despite the offline status, threat intelligence sources have already flagged the domain: VirusTotal reports that 1 of 93 security vendors identified it as malicious, and it appears on two public blocklists, specifically PhishDestroy and ScamSniffer. The Gridinsoft trust score of 0 out of 100 further confirms a lack of reputational trust. The domain is classified as a wallet/seed phishing operation and is listed as impersonating the Ethereum brand, aligning with the known scam type of wallet/seed credential harvesting. Uncertainty remains regarding the current content of the site, as the 403 response prevents direct inspection, and no additional behavioral data (such as phishing page screenshots or payload analysis) is available.

Defenders should continue to block the domain at network perimeter devices, update URL filtering lists with the identified blocklist entries, and monitor for any reactivation attempts. Incident response teams encountering references to quantumsell.pages.dev should treat any associated login or seed phrase requests as fraudulent and advise affected users to invalidate any compromised credentials. Continuous monitoring of Cloudflare-hosted assets for similar impersonation patterns is recommended to reduce exposure to brand‑targeted phishing campaigns.