en-wfaqs-page-base[.]pages[.]dev

The domain en-wfaqs-page-base.pages.dev was registered on October 27, 2025 through Cloudflare, Inc. and resolves to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site is currently offline and returns an HTTP 403 status code, indicating that direct content retrieval is blocked. The page title presented by Cloudflare is "Suspected phishing site | Cloudflare," confirming that the hosting provider has identified the site as a phishing candidate. Infrastructure analysis shows the domain uses Cloudflare’s edge services, with HSTS and HTTP/3 enabled, and the TLS certificate is issued by Google Trust Services under the WE1 root, a standard public‑trusted chain.

Security telemetry indicates the domain appears on a single blocklist and is actively blocked by PhishDestroy. Google Safe Browsing has flagged the URL for social engineering, and VirusTotal records show that ten of ninety‑five scanning engines have raised detections against the domain, reinforcing the malicious assessment. A Gridinsoft trust score of 0 out of 100 further reflects an extremely low reputation. The authoritative nameservers are aleena.ns.cloudflare.com and jack.ns.cloudflare.com, both owned by Cloudflare, confirming the domain’s reliance on that provider’s DNS infrastructure.

The threat is classified as Brand Impersonation, suggesting the site was intended to masquerade as a legitimate brand to harvest credentials or other sensitive information. While the site is offline, the combination of a recent registration date, Cloudflare‑hosted infrastructure, multiple vendor detections, and explicit safe‑browsing warnings provide concrete evidence of malicious intent. Defenders should continue to block the domain at perimeter filters, monitor for any resurgence of activity, and ensure that any user‑generated alerts referencing this domain are treated as high‑confidence indicators of compromise.