bazecoin-acc-login[.]pages[.]dev

Analysis Date: July 23, 2026. The domain bazecoin-acc-login.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and is hosted on Cloudflare’s network (ASN 13335) with the IP address 172.66.46.230 located in the United States. The domain resolves to two Cloudflare nameservers, seamus.ns.cloudflare.com and surina.ns.cloudflare.com, and serves a page whose title is “Suspected phishing site | Cloudflare”. The site presents an HTTP 403 response and is protected by HSTS and HTTP/3, using a TLS certificate issued by Google Trust Services under the WE1 root. VirusTotal scans returned nine positive detections out of ninety‑three vendor engines, and the domain is listed on a single public blocklist and has been blocked by the PhishDestroy sinkhole.

Gridinsoft assigns a trust score of 0 out of 100, indicating a high confidence of malicious intent. The observed threat category is credential phishing, consistent with the page title and the classification in the intelligence feed. Evidence confirms that the infrastructure is fully managed by Cloudflare, which complicates takedown efforts because the service abstracts the underlying hosting. No additional payloads, redirect chains, or credential‑harvesting forms have been observed, and the site is currently offline, limiting immediate victim exposure. However, the presence of multiple security vendor detections suggests that the domain was actively used in phishing campaigns before being taken down.

Defenders should continue to monitor the IP address 172.66.46.230 and the associated Cloudflare nameservers for any re‑registration or reuse. Blocking the domain at DNS or proxy level is recommended, as is adding the IP to network‑wide deny lists. Organizations using web filtering should ensure that the domain is flagged in Safe Browsing and similar services. Ongoing vigilance is required because Cloudflare‑hosted phishing sites can be rapidly redeployed under new subdomains.