yieldbasis-redirect-90431[.]pages[.]dev

Analysis of yieldbasis-redirect-90431.pages.dev shows a high‑risk brand‑impersonation campaign targeting Facebook users. The domain was registered on April 14, 2026 and is hosted on Cloudflare infrastructure (IP 188.114.96.3, located in CA). The site presents an HTTP 403 response and its page title is "Redirect / Anti-DevTools Example," indicating that the page may perform a redirect or employ anti‑debugging techniques, but the actual content has not been publicly examined. The SSL certificate is issued by Google Trust Services under the WE1 name, confirming a valid TLS handshake. Reputation data is poor: Gridinsoft assigns a trust score of 0 / 100, and two of ninety‑four VirusTotal scanners flag the domain. The domain is already listed on three security blocklists and is blocked by PhishDestroy, MetaMask, and SEAL. Nameservers are gerald.ns.cloudflare.com and lilyana.ns.cloudflare.com, confirming Cloudflare registration. Defenders should immediately block the domain and its associated IP at perimeter defenses, add the host to internal threat‑intel feeds, and monitor for any related C2 patterns. Continuous re‑scanning of the URL is recommended to capture any changes in payload or hosting, and any observed redirects should be logged for correlation with credential‑phishing attempts against Facebook accounts.