chain-sync-5s1[.]pages[.]dev

The domain chain-sync-5s1.pages.dev was registered on February 21, 2026 and is hosted behind Cloudflare’s network (AS13335, United States). DNS resolution points to the IP address 188.114.96.3, which belongs to Cloudflare, Inc. The site presents the page title "Suspected phishing site | Cloudflare" and does not serve an SSL certificate, indicating that HTTPS was not configured. Google Safe Browsing has classified the resource as a social engineering threat, and the same classification aligns with the generic phishing type indicated in the intelligence feed.

The domain has been added to at least one public blocklist, specifically PhishDestroy, which actively blocks traffic to the host. VirusTotal analysis shows that 10 of 91 scanned security vendors flagged the domain, reinforcing the suspicion of malicious intent. Current monitoring indicates the site is offline, suggesting that the operator may have taken it down after detection.

While the exact content of the page and the targeted brand, if any, remain unverified, the convergence of DNS, blocklist, Safe Browsing, and multi‑vendor detection signals a high‑risk profile. Defenders should continue to block the domain at network perimeters, update URL filtering rules, and monitor for any re‑appearance of the same host or related subdomains. Additional investigation of the IP address for other potentially malicious assets hosted behind the same Cloudflare edge could reveal broader campaign infrastructure.