home-io-base-eng[.]pages[.]dev

On 23 July 2026, the domain home-io-base-eng.pages.dev was observed to host a suspected phishing page identified by Cloudflare with the title "Suspected phishing site | Cloudflare". The domain was registered on 21 February 2026 through Cloudflare, Inc., and the authoritative name servers are cris.ns.cloudflare.com and bonnie.ns.cloudflare.com. DNS resolution points to the IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc., located in the United States. The site presented an HTTP 403 response when accessed, and the TLS certificate is issued by Google Trust Services under the WE1 root, indicating a valid HTTPS configuration. Security telemetry shows that 13 out of 93 VirusTotal scanners flagged the domain, and Google Safe Browsing classifies it as social engineering.

The domain appears on a single external blocklist and has been actively blocked by the PhishDestroy service. Additional infrastructure indicators include enforced HSTS, Cloudflare edge services, and HTTP/3 support. A Gridinsoft trust score of 0 out of 100 further reflects the high‑risk assessment. The reported scam type is brand impersonation, although the specific victim brand is not disclosed in the available data.

Because the site is currently offline, direct content analysis is unavailable; the page title and the Cloudflare warning page constitute the only visible evidence of the phishing attempt. Defenders should continue to block the domain at network perimeter devices, update DNS sinkhole entries, and monitor for any re‑registration or similar sub‑domains that resolve to the same Cloudflare‑controlled IP range. Correlation with logs that show outbound connections to 188.114.96.3 or TLS handshakes using the Google Trust Services certificate can aid in detecting lingering infection attempts.