en-extntion-msk[.]pages[.]dev

Analysis indicates that the domain en-extntion-msk.pages.dev was registered on 21 February 2026 through Cloudflare, Inc. The authoritative nameservers brenda.ns.cloudflare.com and maxim.ns.cloudflare.com resolve the domain to the Cloudflare edge address 172.66.44.83, which is announced by AS13335 in the United States. The site presented the HTTP response code 403 and the page title “Suspected phishing site | Cloudflare”, suggesting that the content has been taken down by Cloudflare’s takedown process. The SSL certificate was issued by Google Trust Services under the WE1 certificate authority, confirming the use of valid TLS. Threat intelligence feeds have listed the domain on three blocklists, specifically PhishDestroy, MetaMask, and SEAL, and VirusTotal recorded five detections out of ninety‑three scanners.

The Gridinsoft trust score of 0 / 100 further reflects a malicious classification. Detected technologies include HSTS, Cloudflare, and HTTP/3, which are typical of Cloudflare‑protected sites. The only explicitly identified malicious behavior is the classification as “Credential Phishing”. No additional details about the targeted brand or the phishing page content have been disclosed.

Because the domain is currently offline, active exploitation appears to have ceased, but the infrastructure remains usable for future campaigns. Defenders should continue to block the domain and the associated IP address at network perimeter devices, update URL filtering lists with the three blocklist entries, and monitor for any re‑registration of the sub‑domain under the same Cloudflare account. Continuous observation of the Cloudflare nameservers for new A records pointing to the same IP range is recommended, as well as periodic re‑scanning with VirusTotal or similar multi‑engine services to capture any new payloads.