craxsrat2025[.]pages[.]dev

The domain craxsrat2025.pages.dev was registered on 21 February 2026 through Cloudflare, Inc. and is hosted on Cloudflare’s edge network (IP 172.66.45.17, ASN 13335, United States). The authoritative nameservers are desiree.ns.cloudflare.com and kaiser.ns.cloudflare.com, confirming that the domain is under Cloudflare’s DNS service. The site presents the page title “Suspected phishing site | Cloudflare” and the SSL certificate is issued by Google Trust Services (WE1), a standard Cloudflare‑provided certificate. HTTP requests return a 403 status code, and the site employs HSTS and HTTP/3, all typical of Cloudflare‑protected assets.

Reputation services assign extremely low trust scores: Gridinsoft 0/100 and Scamadviser 1/100. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy sink‑hole. VirusTotal analysis shows that 3 of 93 scanners flagged the domain, reinforcing the malicious assessment. The listed scam type is “Brand Impersonation” targeting the Cloudflare brand, and the page title directly references Cloudflare, indicating an attempt to convince visitors that the site is an official Cloudflare resource.

The infrastructure evidence indicates a deliberately crafted impersonation campaign that leverages Cloudflare’s own hosting and SSL infrastructure to gain credibility. Because the domain is currently offline, further content analysis is not possible, and the exact payload or credential‑harvesting mechanism remains unknown. Defenders should continue to block the domain at DNS and proxy layers, monitor for any re‑registration of the same sub‑domain pattern, and add the observed IP address and nameserver pair to threat‑intel feeds. Ongoing vigilance is advised for any new pages that reference the same Cloudflare branding, as the actors may relocate to a different Cloudflare‑hosted domain.