protect-base-extension[.]pages[.]dev

The domain protect-base-extension.pages.dev was first observed on November 08, 2025 when it was registered through Cloudflare, Inc. The authoritative nameservers eva.ns.cloudflare.com and mack.ns.cloudflare.com resolve the name to the Cloudflare edge address 172.66.44.240, which belongs to ASN 13335 located in the United States. The site presents a page title “Suspected phishing site | Cloudflare” and returns an HTTP 403 status code, indicating that the content is being blocked or denied by the hosting provider. SSL termination is supplied by Google Trust Services under the WE1 certificate, confirming the use of a valid TLS chain. Infrastructure fingerprints show the presence of HSTS, Cloudflare services, and HTTP/3 support.

Reputation data shows a Gridinsoft trust score of 0 / 100 and the domain appears on a single security blocklist. It has been actively blocked by PhishDestroy and, as of the report date (July 24 2026), the site is taken offline. VirusTotal records indicate that 14 of 95 scanned security vendors flagged the domain as malicious, providing independent confirmation of its phishing nature. The listed scam type is “Brand Impersonation,” suggesting that the domain is being used to masquerade as a legitimate brand, although the specific brand targeted is not disclosed in the available metadata.

No additional details about the phishing payload, landing page content, or victim interaction have been captured. Analysts should continue to monitor the domain’s DNS and IP reputation, enforce blocklisting in perimeter defenses, and update URL filtering policies to include the observed host name. Given the low trust score, the confirmed vendor detections, and the active takedown, the risk posture remains elevated until the domain is fully cleared from all threat feeds.