bationappverses[.]pages[.]dev

Analysis indicates that the domain bationappverses.pages.dev was registered on April 30 2025 via Cloudflare Pages and resolves to the IP address 172.66.46.252, which is owned by Cloudflare's edge network. The domain is listed on at least one public blocklist and is actively blocked by PhishDestroy. Google Safe Browsing has classified the site under the social engineering category, and VirusTotal reports that 13 of 91 scanned security vendors have flagged the domain as malicious. These detections collectively suggest a high‑confidence phishing operation. The specific payload or impersonated brand has not been disclosed in the available intelligence, and no page title or HTTP response data have been published, leaving the exact content of the site unknown.

The presence on a single blocklist indicates that at least one security community has observed malicious activity, but the limited number of listings does not preclude additional undisclosed sightings. The Cloudflare Pages hosting model provides a legitimate CDN front‑end, which can obscure the true origin of the malicious payload and complicate takedown efforts. Because the domain is relatively new—just over a year old—it may be part of a rotating set of phishing domains used to evade detection. The combination of social engineering classification by Google and multi‑vendor VirusTotal alerts aligns with typical credential‑harvesting campaigns. Defenders should block network traffic to the domain and add the IP address 172.66.46.252 to deny lists.

Email gateways should be configured to quarantine messages containing URLs that resolve to this domain. Continuous monitoring of Cloudflare Pages‑hosted domains is recommended, as the infrastructure can be rapidly provisioned and altered. Incident response teams should treat any credential or credential‑like data submitted to this domain as compromised and advise affected users to reset passwords and review account activity.