businees-verify-badge-vip-12534xcwdd[.]pages[.]dev

The domain businees-verify-badge-vip-12534xcwdd.pages.dev has been identified as a credential phishing endpoint targeting user authentication data. Analysis confirms the domain is currently offline, though it previously hosted infrastructure designed to harvest login credentials through deceptive verification prompts. No specific brand impersonation has been conclusively linked to this domain, but the naming convention suggests an attempt to mimic legitimate verification or badge-related services. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on June 16, 2026, and resolved to the IP address 172.66.44.75. Security vendor detections on VirusTotal indicate 16 of 95 engines flagged the domain as malicious, while Gridinsoft assigned a trust score of 0/100. The domain appears on one security blocklist and was blocked by PhishDestroy. Technical indicators include the use of Cloudflare hosting, HTTP/3 protocol support, HSTS enforcement, and an SSL certificate issued by Google Trust Services. The creation date is anomalous, suggesting either a typo-squatting attempt or a misconfiguration in the registration data. Current assessment places the risk level as elevated due to the domain's prior activity and detection history. While the domain is presently offline, organizations should monitor for re-emergence or similar infrastructure under different subdomains. Recommended actions include blocking the domain and associated IP at network perimeters, updating endpoint detection rules to include this indicator, and conducting internal reviews for any prior exposure. Users should be reminded to verify the legitimacy of verification prompts independently, particularly those requesting credentials outside of official authentication portals.