france-travail-connexion[.]pages[.]dev

On July 23, 2026, the domain france-travail-connexion.pages.dev was confirmed as a credential phishing site. This domain was registered through Cloudflare, Inc. on February 21, 2026. The nameservers are greg.ns.cloudflare.com and carioca.ns.cloudflare.com, and the domain resolves to the IP address 188.114.97.3, which is hosted in the United States under AS13335 Cloudflare, Inc. The SSL certificate for this domain is issued by Google Trust Services, which is WE1. The HTTP status code is 403, indicating that the domain is currently inaccessible, and it appears to be taken offline.

The page title, as found, is 'Suspected phishing site | Cloudflare', which aligns with the domain's classification as a phishing site. The domain has a Gridinsoft trust score of 0/100, reflecting a high level of suspicion. It is also blocked by PhishDestroy and appears on one security blocklist. These indicators, combined with the domain's elevated risk level and the fact that it is offline, suggest that it was likely used for credential phishing attacks.

Defenders should monitor for any reactivation of this domain, as it has a history of malicious activity. They should also ensure that users are aware of the potential risks and have robust phishing detection mechanisms in place. The exact content of the site has not been analyzed, but the available evidence strongly supports the classification of this domain as a credential phishing site.