learnapps-bridg[.]pages[.]dev

On 2026-07-29 the domain learnapps-bridg.pages.dev was observed actively serving a generic phishing campaign. The domain is hosted on Cloudflare’s infrastructure; its authoritative nameservers are michelle.ns.cloudflare.com and stan.ns.cloudflare.com, and the registration record shows Cloudflare, Inc. as the registrar. DNS resolution points to the IPv4 address 172.66.44.251, which is a Cloudflare edge node commonly used for fast content delivery and also for malicious hosting. VirusTotal has indexed the domain and six of ninety‑one participating scanners flagged it as malicious, indicating a moderate level of consensus among anti‑malware engines.

The domain appears on a single external blocklist and is explicitly blocked by the PhishDestroy feed, reinforcing its classification as a phishing resource. The risk assessment assigned by the reporting system is “elevated” and the operational status is listed as “active”, meaning the site is currently reachable and may continue to receive victim traffic. Publicly available telemetry does not include a Safe Browsing verdict, OTX indicator, SSL certificate details, HTTP response code, or page‑title metadata, so those aspects remain unverified. Consequently, analysts cannot confirm whether the site employs HTTPS, what content is displayed, or whether additional infrastructure such as command‑and‑control servers is associated with the IP address.

The limited detection footprint—six vendor detections and a single blocklist entry—suggests that the campaign is either newly deployed or deliberately low‑profile, but the presence of multiple vendor detections signals that known patterns have been identified. Defenders should add learnapps-bridg.pages.dev to web proxy and DNS filtering rules, treat any traffic to the domain as malicious, and monitor outbound connections to the IP 172.66.44.251 for signs of data exfiltration or credential capture.