redirectdevs[.]on[.]fleek[.]co

Analysis of the domain redirectdevs.on.fleek.co, as of July 12, 2026, confirms it is a high-risk site associated with a cryptocurrency scam. The domain is currently flagged by 2 out of 95 security vendors on VirusTotal, indicating a moderate level of detection by the cybersecurity community. Despite this, the site remains active and is blocked by PhishDestroy and ScamSniffer, two reputable security blocklists. The page title 'Multiverse Deep Sync - One wallet, multiverse support' suggests that the site may be attempting to lure users into interacting with a purported cryptocurrency wallet service, which is a common tactic in phishing and scam campaigns targeting cryptocurrency users. The domain is registered through 1API GmbH and uses Cloudflare for its DNS and web infrastructure, with nameservers rihana.ns.cloudflare.com and scott.ns.cloudflare.com. This configuration can provide additional layers of obfuscation and resilience to takedown efforts, making it challenging for defenders to mitigate the threat. The SSL certificate is issued by Google Trust Services, which might be used to instill a false sense of security in potential victims. The domain resolves to the IP address 104.26.14.211, located in the United States and part of the AS13335 Cloudflare, Inc. network. The current HTTP status of 403 indicates that the site may be actively blocking certain types of traffic, possibly to evade detection or to selectively target specific users. Given the high risk level and the nature of the scam, defenders should promptly block access to this domain within their networks and educate users about the risks of interacting with unverified cryptocurrency services. It is also advisable to monitor for any related domains or IP addresses that may be part of the same campaign and to report the domain to additional security vendors for broader protection.