learn-live-en[.]pages[.]dev

This domain, learn-live-en.pages.dev, is flagged as a generic phishing resource targeting user credentials or sensitive information. Analysis indicates no direct association with a specific brand or known phishing kit, though the infrastructure aligns with common credential harvesting tactics. The domain was registered through Cloudflare, Inc., and its content was previously hosted on Cloudflare Pages infrastructure, a pattern observed in transient phishing campaigns designed for rapid deployment and takedown. Technical indicators reveal a VirusTotal detection score of 0/95, suggesting the domain had not yet been widely flagged by security vendors at the time of analysis. The domain was created on April 04, 2026, and resolves to the IP address 188.114.97.3, a Cloudflare-operated endpoint. The SSL certificate is issued by Google Trust Services, a legitimate provider, which is often exploited to lend credibility to malicious sites. Despite the low detection rate, the domain appears on one security blocklist, indicating prior suspicion or confirmed malicious activity. Google Safe Browsing status is not provided, but the domain’s current offline status may limit immediate verification. The domain is currently offline, likely due to takedown actions or infrastructure changes. It was blocked by at least one security provider, and its removal from active service reduces immediate risk to end users. However, the domain’s recent creation date and use of Cloudflare’s hosting infrastructure suggest potential for re-emergence under a similar or altered name. Users who may have interacted with this domain should monitor for unauthorized account access or credential misuse. Organizations are advised to block the domain and associated IP address in perimeter defenses and conduct retrospective log analysis to identify prior exposure. Given the domain’s transient nature, continuous monitoring of newly registered lookalike domains is recommended.