wetestresolved[.]pages[.]dev

Analysis of wetestresolved.pages.dev indicates a high‑risk crypto‑related phishing campaign that was taken offline prior to the report date of July 24, 2026. The domain was created on March 03, 2026 and is registered through Cloudflare, Inc., using the authoritative nameservers angela.ns.cloudflare.com and gannon.ns.cloudflare.com. DNS resolution points to IP address 172.66.44.83, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site employed modern transport security, advertising HSTS and HTTP/3 support, and presented a TLS certificate issued by Google Trust Services under the WE1 imprint, confirming the use of a valid HTTPS endpoint.

An HTTP request to the host returned a 403 status code, and the page title returned by the server was "Suspected phishing site | Cloudflare," suggesting that Cloudflare’s protective interstitial was triggered. Google Safe Browsing has flagged the domain for social engineering, and three independent blocklists—PhishDestroy, MetaMask, and SEAL—have listed it as malicious. VirusTotal analysis recorded nine detections out of ninety‑four scanned security vendors, reinforcing the malicious classification. Additionally, Gridinsoft assigned a trust score of zero out of one hundred, indicating an extremely low reputation.

The intelligence labels the campaign as a crypto scam, though no further details about the specific lure or victim interaction are available. Defenders should immediately block the domain and its resolving IP at perimeter and endpoint controls, incorporate the observed identifiers (domain name, IP range, Cloudflare nameservers) into threat‑intel feeds, and monitor for new domains registered with the same registrar or employing similar Cloudflare‑hosted infrastructure. Because the site is currently offline, continuous re‑resolution checks are advisable to detect potential re‑hosting or replica deployments.