better-base-site[.]pages[.]dev

Analysis of the domain better-base-site.pages.dev indicates active brand impersonation targeting users of database backup services. The domain, registered on March 28, 2026, through Cloudflare Pages, resolves to the IP address 188.114.97.3, associated with Cloudflare, Inc. in Canada. The page title, 'BetterBase - Postgres backups made easy,' suggests an attempt to mimic legitimate Postgres backup solutions, though the exact content and functionality of the site remain unconfirmed due to the absence of direct inspection. Infrastructure analysis reveals the domain is hosted on Cloudflare's content delivery network, a common tactic to obscure the origin of malicious activity. The SSL certificate, issued by Google Trust Services (WE1), is consistent with Cloudflare's default configuration and does not inherently indicate legitimacy. The domain appears on one security blocklist, specifically PhishDestroy, and has been assigned a trust score of 0/100 by Gridinsoft, further supporting its classification as malicious. No detections were reported by the 94 vendors that scanned the domain on VirusTotal, though this absence does not confirm safety. The domain remains active as of July 12, 2026, and is classified as a generic phishing threat under investigation. Defenders are advised to treat this domain as high-risk, particularly for organizations utilizing Postgres databases. Monitoring for connections to 188.114.97.3 and implementing blocklist updates are recommended mitigations. Additional analysis of the site's content and backend infrastructure is necessary to determine the full scope of the campaign.