verify-badge-vip18[.]pages[.]dev

Analysis of verify-badge-vip18.pages.dev indicates active credential phishing activity with an elevated risk rating. The domain was created on September 02, 2020 and is hosted via Cloudflare Pages, resolving to the IP address 172.66.44.128, which is part of Cloudflare's shared infrastructure. The domain is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy anti‑phishing service, confirming that it is recognized as malicious by at least one reputable mitigation platform.

VirusTotal scans show that 17 of 91 security vendors have flagged the domain, reinforcing the suspicion of malicious intent. No additional public intelligence, such as Safe Browsing status, OTX mentions, or detailed page title information, has been published for this host, leaving the exact phishing campaign content undefined. Infrastructure evidence points to a typical abuse pattern: a relatively old domain (nearly six years) repurposed on a free hosting service to evade detection, leveraging Cloudflare's CDN to obscure the true origin.

Defenders should treat any traffic to or from this domain as hostile. Recommended actions include blocking the domain at the DNS or proxy layer, updating intrusion detection signatures to flag connections to 172.66.44.128 when associated with credential‑harvesting URLs, and monitoring for any credential submissions that may have been redirected to this host. Continuous re‑evaluation is advised, as further threat intel may emerge regarding the specific phishing vectors employed.