ctrlcenterx-ai17l11d-systemnetworkw[.]pages[.]dev

The domain ctrlcenterx-ai17l11d-systemnetworkw.pages.dev was registered on 16 November 2025 through Cloudflare, Inc. and resolves to the Cloudflare address 172.66.47.92 (AS13335, United States). The site presents a Cloudflare‑generated block page with the title “Suspected phishing site | Cloudflare” and returns HTTP 403, indicating that the content has been taken offline. The SSL certificate is issued by Google Trust Services under the WE1 label, consistent with Cloudflare‑hosted services.

Network analysis shows the use of HTTP/3 and enforced HSTS, confirming that the infrastructure relies on Cloudflare’s edge platform. Reputation services assign extremely low scores: Gridinsoft rates the domain 0 / 100, Scamadviser 1 / 100, and the domain appears on a single security blocklist. PhishDestroy has already blocked the host, and VirusTotal reports 15 detections out of 95 scanned vendors, reinforcing the malicious assessment.

The observed scam type is credential phishing, though the specific target brand or credential field is not disclosed in the available data. Given the elevated risk rating and the combination of Cloudflare hosting, low trust metrics, and multi‑vendor detection, defenders should add the domain to outbound and inbound filtering rules, monitor DNS queries for the IP address 172.66.47.92, and ensure that any credential‑capture vectors referencing this host are blocked. Continued observation is advised in case the site is re‑activated or the infrastructure is reused for other phishing campaigns.