languagetutor[.]pages[.]dev

This domain, languagetutor.pages.dev, is currently under investigation for operating a phishing site impersonating legitimate language education services. Analysis indicates the page masquerades as an online academy offering English and Polish courses, likely designed to harvest user credentials or financial information under the guise of educational enrollment. The specific threat type appears to be brand impersonation combined with credential harvesting, targeting individuals seeking language instruction. Infrastructure analysis reveals the domain was registered on April 01, 2026, through Cloudflare, Inc., and resolves to the IP address 188.114.96.3, which is geolocated to Canada and associated with Cloudflare's network. The SSL certificate is issued by Google Trust Services (WE1), a common configuration for content delivery networks. Despite the active status, only 0 of 95 VirusTotal security vendors have flagged the domain at the time of analysis. The domain appears on exactly one security blocklist, suggesting limited detection thus far. The page title, 'Easy Language Academy - Learn English, Polish,' directly mimics legitimate educational platforms to enhance credibility. Current assessment indicates this phishing infrastructure remains operational with minimal detection coverage. Organizations and individuals are advised to implement immediate network-level blocking of languagetutor.pages.dev and its resolving IP 188.114.96.3. End users should be cautioned against entering any personal or financial information on the site, particularly during language course registration prompts. Security teams are recommended to monitor for additional domains using similar naming conventions (e.g., 'language[word].pages.dev') and to correlate this activity with other Cloudflare Pages-hosted phishing campaigns. Given the domain's recent creation date and low detection rate, heightened scrutiny of similar educational-themed phishing sites is warranted.