get-browser-en-extension[.]pages[.]dev

The domain get-browser-en-extension.pages.dev is currently flagged as a high‑risk credential‑phishing site. It was registered on February 21 2026 through Cloudflare, Inc., and resolves to the Cloudflare edge address 172.66.47.73 located in the United States under ASN 13335. The site serves a single page titled “Suspected phishing site | Cloudflare” and returns HTTP 403, indicating that the content has been taken offline. Cloudflare’s infrastructure provides HSTS, HTTP/3, and the SSL certificate is issued by Google Trust Services / WE1, confirming a valid TLS chain.

Nameservers listed are magdalena.ns.cloudflare.com and ivan.ns.cloudflare.com. Reputation data show a Gridinsoft trust score of 0 / 100 and Google Safe Browsing classifies the URL as social‑engineering. VirusTotal recorded 11 detections out of 93 scanners, and the domain appears on one external blocklist, where PhishDestroy has already listed it. The page title and the scam type “Credential Phishing” are the only publicly observable indicators; no additional payload, landing‑page screenshots, or target brand information have been disclosed.

Uncertainty remains around the exact phishing lures used, because the offline status prevents content inspection. Analysts should treat any traffic to this host as malicious, block the IP address 172.66.47.73 and the associated nameservers at the DNS layer, and add the domain to local URL filtering lists. Continuous monitoring of Cloudflare‑originated subdomains is advised, as the registrar can rapidly generate new hosts sharing the same infrastructure. Defensive teams should also reference the 11 VirusTotal detections and Google Safe Browsing flag when prioritising alerts.