divace--secure--uoinbase[.]pages[.]dev

The domain divace--secure--uoinbase.pages.dev was registered on February 21 2026 through Cloudflare, Inc. and resolves to the Cloudflare edge address 172.66.44.68, an IP located in the United States and associated with ASN 13335 (Cloudflare, Inc.). The authoritative nameservers listed are mina.ns.cloudflare.com and rajeev.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure. The site currently returns an HTTP 403 status and its page title is "Suspected phishing site | Cloudflare," indicating that the content has been taken down or blocked by the provider. Security‑vendor scanning on VirusTotal shows that 12 of 95 engines flagged the domain, and Google Safe Browsing categorises it as a social‑engineering threat.

The site appears on at least one public blocklist and is specifically listed by PhishDestroy as a malicious entry. Reputation services assign extremely low trust scores—Scamadviser rates it 1 / 100 and Gridinsoft 0 / 100—reinforcing the malicious assessment. The TLS certificate presented is issued by Google Trust Services under the WE1 identifier, a common certificate for Cloudflare‑proxied sites, and the connection enforces HSTS and HTTP/3. The overall threat profile is identified as brand impersonation aimed at credential harvesting, consistent with a credential‑phishing campaign.

Uncertainty remains regarding the exact phishing payload, target brand, and any harvested credentials because the page content is not publicly available; the 403 response prevents direct analysis of the landing page. Defenders should block the domain at perimeter and DNS layers, add the IP 172.66.44.68 to deny‑lists for traffic originating from internal users, and monitor for any outbound connections to Cloudflare edge nodes that could be used for proxying. Endpoint security solutions should incorporate the VirusTotal detection count and Google Safe Browsing flag to raise alerts on any attempted access.