bbbbb-371[.]pages[.]dev

Analysis of bbbbb-371.pages.dev indicates that the domain is actively being used for credential phishing. The site was registered through Cloudflare, Inc. on 23 March 2026 and is presently taken offline, returning HTTP 403 responses. DNS resolution points to the Cloudflare edge IP 188.114.97.3, which is associated with the Cloudflare service in Canada. The domain’s authoritative nameservers are garrett.ns.cloudflare.com and pearl.ns.cloudflare.com, confirming that the hosting infrastructure is provided by Cloudflare. The TLS certificate presented is issued by Google Trust Services under the WE1 issuer, matching a legitimate certificate chain, which may be intended to lend credibility to the phishing page.

Public threat intelligence sources have flagged the domain on two blocklists: PhishDestroy and ScamSniffer. VirusTotal analysis shows that six of ninety‑four scanning engines have marked the domain as malicious, reinforcing the suspicion of abuse. The Gridinsoft trust scoring system assigns a score of 0 out of 100, indicating a high confidence of malicious intent. The page title returned by the server is “Suspected phishing site | Cloudflare,” which directly labels the content as a phishing placeholder.

The available evidence confirms a credential‑phishing operation, though the specific target brand or credential type has not been disclosed. No additional payloads, redirects, or malicious scripts have been observed in the limited data set, leaving the exact attack vector uncertain. Defenders should block the domain at DNS and proxy layers, add the IP address 188.114.97.3 to deny lists, and ensure that any cached credentials or session cookies associated with the domain are invalidated. Continuous monitoring for re‑registration or alternative subdomains on the same Cloudflare account is advised, as threat actors frequently leverage the same infrastructure for new campaigns.