aaddons-mozilla-org[.]pages[.]dev

Analysis of the domain aaddons-mozilla-org.pages.dev indicates a high‑risk credential phishing operation that has been taken offline as of the report date, July 25, 2026. The domain was registered on February 21, 2026 through Cloudflare, Inc., and its authoritative nameservers are reza.ns.cloudflare.com and brett.ns.cloudflare.com, confirming Cloudflare as the hosting provider. DNS resolution points to IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presented the title "Suspected phishing site | Cloudflare" and returned an HTTP 403 status before being removed, suggesting the content was blocked by Cloudflare’s security controls.

The TLS certificate is issued by Google Trust Services under the WE1 identifier, indicating a valid HTTPS connection that nevertheless does not mitigate the malicious intent. Security telemetry shows the domain is flagged by Google Safe Browsing for social engineering, appears on one external blocklist, and has been listed by PhishDestroy as a blocked credential‑phishing site. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reflecting extreme suspicion. VirusTotal analysis reports that 10 of 93 scanned security vendors flagged the domain, reinforcing the threat assessment.

Detected technologies include HTTP/3, HSTS enforcement, and Cloudflare’s edge services, all of which are typical for fast‑flow phishing infrastructure. Defenders should continue to block the domain at network perimeter devices, update URL filtering policies, and monitor for any re‑registration attempts. Given the confirmed phishing classification, organizations should educate users about unsolicited credential requests and enforce multi‑factor authentication to reduce the impact of potential credential compromise.