con-bse-walet-extnsen-in[.]pages[.]dev

Analysis of the domain con-bse-walet-extnsen-in.pages.dev indicates it is a confirmed phishing site hosted on Cloudflare's infrastructure. The domain, registered through Cloudflare, Inc. on September 2, 2020, resolves to the IP address 172.66.44.186, which is assigned to AS13335 (Cloudflare, Inc.) and geolocated in the United States. Nameservers adi.ns.cloudflare.com and karl.ns.cloudflare.com further confirm Cloudflare as the hosting and DNS provider. The domain is currently offline, returning an HTTP 403 status with the page title 'Suspected phishing site | Cloudflare,' which aligns with Cloudflare's automated flagging mechanisms for malicious content. Detection data reveals the domain is listed on at least one security blocklist, specifically PhishDestroy.

Google Safe Browsing categorizes the site as engaging in social engineering, a classification consistent with phishing activity. Fifteen out of ninety-three security vendors on VirusTotal flagged the domain as malicious, though the absence of additional context limits attribution to a specific phishing kit or targeted brand. The SSL certificate, issued by Google Trust Services (WE1), provides no additional indicators of compromise beyond standard encryption practices. Infrastructure analysis reveals the use of HTTP Strict Transport Security (HSTS), a security feature often employed to prevent downgrade attacks, though its presence here does not mitigate the domain's malicious classification.

The Gridinsoft trust score of 0/100 further corroborates the domain's high-risk status. While the exact content and target of the phishing campaign remain unconfirmed due to the domain's offline status, the combination of detection data, hosting provider flags, and blocklist inclusion provides sufficient evidence to classify this as a high-risk phishing domain. Defenders should treat this domain as malicious and maintain blocklist entries to prevent user exposure.