secure-logn-cnbase-learn[.]pages[.]dev

The domain secure-logn-cnbase-learn.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and is hosted on Cloudflare’s network (ASN 13335) with the IP address 172.66.47.164 located in the United States. The domain resolves to two Cloudflare nameservers, becky.ns.cloudflare.com and frank.ns.cloudflare.com, indicating the use of Cloudflare’s DNS and CDN services. An SSL certificate issued by Google Trust Services (WE1) is present, but the HTTP response returns a 403 status code, suggesting the site is currently inaccessible or deliberately blocked. The page title returned by the server is "Suspected phishing site | Cloudflare," which aligns with the declared scam type of brand impersonation for credential phishing.

Reputation checks show a Gridinsoft trust score of 0 / 100, and VirusTotal recorded detections from 15 of 93 security vendors, reinforcing the malicious assessment. Google Safe Browsing flags the domain for social engineering, and PhishDestroy has listed the domain as blocked, with it appearing on one external security blocklist. The overall risk level is classified as high, and the domain status is offline at the time of analysis.

While the technical infrastructure confirms the presence of typical phishing infrastructure—cloud hosting, low trust scores, multiple vendor detections—no additional content samples or payloads have been captured, leaving the exact phishing lure and target brand unspecified beyond the generic brand‑impersonation label. Defenders should immediately block the domain and its associated IP addresses at perimeter firewalls and DNS filtering solutions, monitor for newly created sub‑domains under the same registrar, and incorporate the observed indicators (IP, nameservers, SSL issuer, detection counts) into threat‑intel feeds.