astroportfolio2[.]pages[.]dev

The domain astroportfolio2.pages.dev is flagged as a high‑risk brand impersonation campaign targeting LinkedIn. Infrastructure analysis shows the domain was registered on July 31, 2025 and resolves to the Cloudflare edge address 104.21.32.1, hosted within AS13335. The authoritative nameservers are dawn.ns.cloudflare.com and rajeev.ns.cloudflare.com, indicating the registration and DNS services are provided by Cloudflare. The site serves over HTTPS with HSTS enabled and HTTP/3 support, and the TLS certificate is issued by Cloudflare TLS Issuing ECC CA 3 under the SSL Corporation label. Page metadata reveals a title of "Cody Hall" but no further content has been disclosed. The domain appears on a single security blocklist (PhishDestroy) and received a single positive detection from 91 VirusTotal scanners, while the Gridinsoft trust score is 0/100. Current status is active. Defenders should add astroportfolio2.pages.dev to web‑filter block lists and monitor DNS queries for the associated IP address. Because the site leverages Cloudflare’s global network, traditional IP‑based blocking may affect legitimate traffic; therefore, URL‑filtering rules that match the exact domain or its sub‑path should be employed. Continuous threat‑intel feeds should be consulted for any additional indicators, and SOC analysts should treat any authentication attempts to LinkedIn that originate from this domain as compromised. Evidence is limited to the infrastructure and blocklist data; no page content analysis is available, so further investigation of the landing page is recommended if safe‑browse environments permit.