linkexp[.]pages[.]dev

Analysis of linkexp.pages.dev shows a newly created domain (registered on March 30, 2026) that is currently active and serves content over HTTPS with a Google Trust Services / WE1 certificate. The domain resolves to IP address 172.66.46.244, an infrastructure owned by Cloudflare, Inc., located in Canada. DNS is managed by Cloudflare with nameservers carlos.ns.cloudflare.com and sreeni.ns.cloudflare.com, and the registration was performed through Cloudflare, Inc. The web server returns HTTP status 200 and employs modern web technologies including Bootstrap, jQuery, HSTS, and HTTP/3, all delivered via Cloudflare's edge network. The page title reported by crawlers is "LINK EXPLORE," but no further content analysis is available. Threat intelligence classifies the site as a "Crypto Drainer" type of phishing campaign. The domain has been observed on a single security blocklist and is blocked by a known anti‑phishing service. A public scan on a multi‑vendor analysis platform involved 94 vendors, none of which reported detections at the time of the scan, and the Gridinsoft trust score is 0 out of 100. While these metrics do not confirm malicious intent, the combination of recent creation, association with a crypto‑draining phishing profile, and inclusion on a blocklist suggests a heightened risk. Defenders should continue to monitor the domain, block network traffic to the IP address 172.66.46.244, and enforce URL filtering policies that flag linkexp.pages.dev. Additional investigation of the site’s payload and any associated command‑and‑control endpoints is recommended to confirm the threat vector.