home-exten-memask[.]pages[.]dev

home-exten-memask.pages.dev is flagged as a credential‑phishing site. The domain was registered on 21 February 2026 through Cloudflare, Inc. and resolves to 172.66.46.232, an IP owned by AS13335 Cloudflare, Inc. located in the United States. DNS is served by ruben.ns.cloudflare.com and jewel.ns.cloudflare.com, both Cloudflare name‑servers. HTTPS is presented with a Google Trust Services / WE1 certificate, indicating a valid TLS chain, while the web server returns HTTP 403 and displays the page title “Suspected phishing site | Cloudflare”.

VirusTotal has recorded 11 of 93 security‑vendor detections for this host, and Gridinsoft assigns a trust score of zero out of one hundred. Google Safe Browsing classifies the URL as social‑engineering, and PhishDestroy has taken the domain offline, listing it on a single security blocklist. The current status is offline, and the site is no longer reachable. Analysis confirms that the infrastructure is typical of abuse‑as‑a‑service deployments that leverage Cloudflare’s free tier to hide origin details while serving malicious content.

The combination of a zero trust score, multiple vendor detections, and a Google Safe Browsing flag provides concrete evidence of malicious intent. However, no payload samples, phishing page screenshots, or target brand information have been published, leaving the exact victim‑targeting methodology uncertain. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the host on threat‑intel feeds, and consider adding the IP address 172.66.46.232 to reputation‑based deny lists. Ongoing surveillance of Cloudflare‑hosted subdomains with similar creation dates is advised, as threat actors frequently recycle the same hosting environment for new campaigns.