learn-extesion-base[.]pages[.]dev

The domain learn-extesion-base.pages.dev was registered on September 26, 2025 through Cloudflare, Inc., and resolves to the Cloudflare edge address 172.66.47.11 located in the United States under ASN 13335. The site is protected by HSTS and served over HTTP/3, with an SSL certificate issued by Google Trust Services (WE1). When accessed, the server returned HTTP 403 and the page title displayed "Suspected phishing site | Cloudflare," indicating that the content was flagged and taken offline. VirusTotal recorded 11 detections out of 95 security vendors, and the domain appears on a single security blocklist.

Google Safe Browsing classified the site as a social engineering threat, and PhishDestroy has also blocked it. The Gridinsoft trust score is 0 out of 100, reinforcing the malicious assessment. The registrar and nameservers (ivan.ns.cloudflare.com, kia.ns.cloudflare.com) are consistent with the Cloudflare hosting environment, which is commonly abused for fast‑flux style phishing infrastructure.

While the specific brand being impersonated is not disclosed in the available data, the scam type is identified as brand impersonation, suggesting that the site was likely used to lure victims by mimicking a legitimate service. Defenders should continue to block the domain at the network perimeter, update URL filtering and DNS sinkhole lists, and monitor for any related subdomains or similar Cloudflare‑hosted assets that may appear in future campaigns. Incident response teams should also correlate logs for connections to 172.66.47.11 and consider reporting the domain to additional threat‑sharing platforms to improve collective detection.