baseprosignin[.]pages[.]dev

Analysis of the domain baseprosignin.pages.dev indicates that it was registered through Cloudflare, Inc. on 21 February 2026. The authoritative nameservers are laylah.ns.cloudflare.com and kanye.ns.cloudflare.com, both pointing to Cloudflare’s edge network. DNS resolution returns the IP address 172.66.47.136, which belongs to AS13335 Cloudflare, Inc. and is geolocated to the United States. The site served an SSL certificate issued by Google Trust Services under the WE1 designation, and the HTTP response returned a 403 status code while employing HSTS and HTTP/3, confirming the presence of Cloudflare as the front‑end service.

The page title reported by automated scanners is “Suspected phishing site | Cloudflare”, and the listed scam type is credential phishing. VirusTotal scans have flagged the domain in 12 of 93 security vendors, and the domain appears on a single public blocklist. Gridinsoft assigns a trust score of 0 / 100, and the domain has been blocked by PhishDestroy. Current status is offline, suggesting the payload has been taken down or the operator ceased activity.

Given the available evidence, the infrastructure is typical of a credential‑phishing campaign that leverages Cloudflare’s CDN to hide the origin server. The relatively high vendor detection count and the low trust score reinforce the malicious assessment, but the absence of further indicators such as phishing kit fingerprints or victim reports limits attribution. Defenders should continue to block the domain at DNS and proxy layers, monitor for reuse of the associated IP address or Cloudflare‑assigned subdomains, and consider adding the indicator to internal threat‑intel feeds. Ongoing observation of the IP 172.66.47.136 for unrelated malicious traffic is advisable, as Cloudflare hosting may be repurposed by other actors.