feymoney[.]pages[.]dev

The domain feymoney.pages.dev was registered on February 21, 2026 and is hosted behind Cloudflare, Inc. Infrastructure analysis shows the domain resolves to IP address 172.66.46.233, which belongs to AS13335 (Cloudflare) and is geolocated in the United States. No SSL certificate was observed for the host, indicating that the site does not serve traffic over HTTPS. The page title returned from the site, "FEY," provides the only visible content clue; no additional page content or functionality has been captured because the service is currently taken offline.

Threat intelligence flags the domain on two security blocklists—PhishDestroy and ScamSniffer—and two of ninety‑three VirusTotal scanners have marked it as malicious, reinforcing the suspicion of phishing activity. The lack of an active certificate, combined with the blocklist entries and the limited detection by VirusTotal, suggests the domain was used for a short‑lived phishing campaign before being shut down. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any re‑registration or resurrection of the host, and consider adding the IP address 172.66.46.233 to threat‑intel feeds for rapid detection of future abuse.

Because the site is offline, content‑level analysis is unavailable, and the exact phishing vector or targeted brand remains unknown. Ongoing observation of Cloudflare‑hosted assets and periodic re‑scans are recommended to capture any re‑emergence of malicious activity.