netamask--extension[.]pages[.]dev

The domain netamask--extension.pages.dev was registered on 21 February 2026 through Cloudflare, Inc. and is hosted on Cloudflare’s network (AS13335) with the IP address 172.66.47.4 located in the United States. The site presents a Cloudflare‑issued SSL certificate signed by Google Trust Services (WE1) and enforces HSTS over HTTP/3, returning an HTTP 403 response at the time of inspection. The page title returned by the server is “Suspected phishing site | Cloudflare,” indicating that the content has been taken down or flagged by Cloudflare’s protective mechanisms. Google Safe Browsing classifies the domain as a social‑engineering threat, and VirusTotal records 16 positive detections out of 93 scanned security vendors, confirming malicious intent.

Independent reputation services assign extremely low trust scores, with Gridinsoft reporting 0/100 and Scamadviser 1/100, and the domain appears on a single known blocklist and is actively blocked by PhishDestroy. The only documented scam type is credential phishing, suggesting that the domain was intended to harvest login credentials for an unspecified target. Nameserver configuration uses roman.ns.cloudflare.com and lorna.ns.cloudflare.com, consistent with the registrar’s default settings. At the time of this report the site is offline, returning a 403 status, which limits immediate payload retrieval but does not eliminate the risk of prior data collection or future re‑activation.

Uncertainty remains regarding the specific brands or services whose credentials were being targeted, as no landing page content has been captured. Defenders should continue to block the domain at perimeter and DNS layers, monitor for resurrection attempts, and add the IP address 172.66.47.4 to threat‑intel feeds. Incident response teams should also review any recent credential‑theft alerts that may correlate with activity from this infrastructure, and users should be warned to disregard unsolicited login requests that reference this domain.