earn-rxrfa3[.]pages[.]dev

The domain earn-rxrfa3.pages.dev is currently flagged as a high-risk phishing resource targeting user credentials. Analysis indicates this is a generic_phishing campaign, with no specific brand impersonation identified at this time. The domain remains active and operational, presenting an ongoing threat to users who may encounter it through malicious links or redirects. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on May 03, 2026, with an SSL certificate issued by Let’s Encrypt (serial number E8). It resolves to the IP address 172.66.47.91, geolocated to Cloudflare’s infrastructure in Canada. Detection metrics show limited but concerning coverage: only 1 of 95 security vendors on VirusTotal currently flag the domain, while a single blocklist (PhishDestroy) has incorporated it into its denylist. The page title 'Connection Failed' suggests an attempt to mimic technical errors, potentially to deceive users into re-entering credentials or engaging with malicious prompts. Current evidence confirms the domain remains active, with no signs of takedown or mitigation. Users and network administrators are advised to block the domain at the DNS or proxy level, particularly in environments where credential security is critical. Endpoint protection systems should be updated to include this indicator of compromise (IOC), and security teams should monitor for connections to 172.66.47.91 or subdomains of pages.dev associated with phishing activity. Given the domain’s recent creation and minimal detection coverage, heightened vigilance is recommended for related infrastructure.