divace-basepro-com-en[.]pages[.]dev

Analysis of divace-basepro-com-en.pages.dev shows a domain created on 21 February 2026 and immediately hosted behind Cloudflare’s network (AS13335). The domain resolves to IP 172.66.47.3, which belongs to Cloudflare, Inc., and the TLS certificate is issued by Google Trust Services (WE1). The site returns an HTTP 403 status and the page title reported by crawlers is “Suspected phishing site | Cloudflare”, indicating that the content has been taken down by Cloudflare’s mitigation system. Infrastructure fingerprints include HSTS enforcement and HTTP/3 support, both typical of Cloudflare‑protected sites.

Reputation signals are strongly negative. The Gridinsoft trust score is 0 / 100, and ten of ninety‑five VirusTotal scanners have flagged the domain as malicious. PhishDestroy has listed the domain as blocked, and it appears on a single public blocklist. The brand‑impersonation scam type is explicitly noted, though the targeted brand is not disclosed in the available data.

The domain is currently offline, which limits immediate observation of payloads or credential‑harvesting pages. Nevertheless, the combination of a newly registered domain, Cloudflare hosting, a low trust score, multiple vendor detections, and blocklist entries constitutes sufficient evidence for an elevated risk rating. Defenders should continue to block the domain at network perimeter and endpoint layers, monitor DNS queries for the host name, and include it in threat‑intel feeds. Because the site is hosted on a shared Cloudflare IP, any future re‑use of the same address may not indicate the same actor, but the domain name itself should remain on deny lists until a formal takedown confirmation is received.