extn-walle-base[.]pages[.]dev

Analysis of extn-walle-base.pages.dev performed on July 23, 2026 indicates that the domain is associated with a high‑risk generic phishing campaign targeting brand impersonation. The domain was registered on February 21, 2026 through Cloudflare, Inc., and is served from Cloudflare’s network (nameservers kolton.ns.cloudflare.com and raina.ns.cloudflare.com). DNS resolution points to IP address 172.66.47.177, which belongs to AS13335 owned by Cloudflare, Inc., and is geolocated in the United States. The site presents an HTTPS certificate issued by Google Trust Services under the WE1 certificate profile, confirming that TLS termination is performed by Cloudflare’s edge. HTTP requests return a 403 status, and the page title returned by the server is “Suspected phishing site | Cloudflare”, indicating that Cloudflare has flagged the content as malicious. The hosting environment enforces HTTP Strict Transport Security and supports HTTP/3, consistent with modern Cloudflare deployments.

Threat intelligence sources reinforce the malicious classification. Google Safe Browsing flags the domain for social engineering, and 14 out of 93 antivirus engines on VirusTotal have generated detections. The domain appears on a single security blocklist and has been actively blocked by PhishDestroy. A Gridinsoft trust score of 0 / 100 further underscores the lack of legitimacy. The listed scam type is brand impersonation, suggesting that the site may be used to harvest credentials or personal data by masquerading as a trusted brand, although the specific victim brand is not disclosed in the available data.

Uncertainty remains regarding the exact content served before the site was taken offline, as the HTTP 403 response prevents retrieval of the page body, and no visual description is available. No additional indicators such as malware payloads, command‑and‑control infrastructure, or malicious scripts have been observed in public repositories.