extrafii[.]pages[.]dev

Analysis of the domain extrafii.pages.dev indicates a confirmed fake exchange phishing site, currently active as of July 12, 2026. The domain was registered on March 28, 2026, through Cloudflare, Inc., and resolves to the IP address 188.114.96.3, located in Canada and associated with Cloudflare's infrastructure. The page title explicitly displays 'Extra Finance,' suggesting an attempt to impersonate a financial or cryptocurrency exchange service, consistent with the scam type labeled as 'Fake Exchange' in available threat intelligence. The domain is flagged by two security vendors on VirusTotal, though the specific detection names or signatures are not disclosed. It appears on two security blocklists, further corroborating its malicious classification. The site employs standard web technologies, including Ant Design, HSTS, and HTTP/3, and is secured with an SSL certificate issued by Google Trust Services (WE1). Nameservers are hosted under Cloudflare (ajay.ns.cloudflare.com and nancy.ns.cloudflare.com), a common pattern for phishing domains leveraging Cloudflare's free services to obscure origin infrastructure. No evidence of credential harvesting mechanisms, redirect chains, or payload delivery has been confirmed in this report, as the domain's content has not been directly analyzed. However, the combination of a recent registration date, low trust score (0/100), and active blocklist presence strongly supports its classification as a high-risk phishing site. Defenders should treat this domain as malicious and prioritize blocking it at the DNS or network level. Additional monitoring for related subdomains or IP associations is recommended, particularly within Cloudflare's IP ranges, to identify potential lateral movement or secondary attack vectors.