en-exten-base[.]pages[.]dev

Analysis of the domain en-exten-base.pages.dev indicates a high-risk phishing operation detected on July 23, 2026. The domain, registered through Cloudflare on February 21, 2026, resolves to IP 172.66.47.167 (AS13335, Cloudflare, Inc., US) and is currently offline, returning HTTP 403 status. Google Safe Browsing flags the domain for social engineering, while Gridinsoft and Scamadviser assign trust scores of 0/100 and 1/100, respectively.

The page title, 'Suspected phishing site | Cloudflare,' aligns with its classification as brand impersonation, though the specific brand targeted remains unconfirmed due to lack of additional evidence. Security vendor detections include 13 flags from 93 engines on VirusTotal, and the domain appears on one security blocklist. Infrastructure analysis reveals Cloudflare nameservers (journey.ns.cloudflare.com, matias.ns.cloudflare.com), HSTS enforcement, and an SSL certificate issued by Google Trust Services (WE1).

The domain's hosting on Cloudflare Pages and its use of HTTP/3 further complicate attribution, as no distinct phishing kit or payload is identifiable from the available data. Defenders should treat this domain as malicious, block resolution at DNS and proxy levels, and monitor for re-emergence under similar Cloudflare-hosted subdomains. No evidence suggests active exploitation post-takedown, but historical logs should be reviewed for connections to 172.66.47.167 or the domain itself.