tealsmoorebag[.]pages[.]dev

Analysis of tealsmoorebag.pages.dev shows a domain actively leveraged for phishing as of the report date, July 24, 2026. The domain was created on February 26, 2025 and is registered through Cloudflare, Inc., using the nameservers dana.ns.cloudflare.com and west.ns.cloudflare.com. DNS resolution points to IP address 172.66.46.220, which belongs to AS13335 Cloudflare, Inc., located in the United States. An HTTPS certificate issued by Google Trust Services (WE1) is present, indicating the site employs a valid TLS certificate to increase credibility.

The observed page title, "Decentralized Dapps - We are unifying Web3 by providing best-in-class, self-custodial, and multichain support," suggests an attempt to imitate Web3 or cryptocurrency services, a common lure for credential harvesting. HTTP responses return a 403 status, and the site is currently offline, having been taken down. Threat intelligence indicates the domain appears on one security blocklist and is blocked by PhishDestroy. VirusTotal reports two detections out of ninety‑one scanners, and Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious classification.

While the exact phishing payload or target brand is not disclosed, the combination of blocklist presence, low trust score, and detection by multiple scanners substantiates the phishing designation. Defensive operators should add the domain and its IP to deny‑list configurations, monitor for any re‑hosting under other Cloudflare accounts, and continue to reference blocklist feeds that already flag this indicator. Further scrutiny of traffic aimed at the IP address may reveal additional malicious activity linked to the same infrastructure.