overview-bass-ultra[.]pages[.]dev

On 23 July 2026 the domain overview-bass-ultra.pages.dev was evaluated after being taken offline. The site returned an HTTP 403 response with the page title “Suspected phishing site | Cloudflare,” indicating that Cloudflare’s protective page was presented to visitors. The domain was created on 31 October 2025 and is registered through Cloudflare, Inc. DNS resolution points to 172.66.44.254, an address owned by AS13335 Cloudflare, Inc. and geolocated in the United States. The service advertises HSTS and supports HTTP/3, confirming modern Cloudflare infrastructure. The TLS certificate is issued by Google Trust Services under the WE1 label, which is typical for Cloudflare‑hosted domains.

Threat intelligence shows that 15 of 95 VirusTotal scanners flagged the domain as malicious, and the site appears on one external security blocklist. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious assessment. The nameservers chuck.ns.cloudflare.com and zelda.ns.cloudflare.com are standard Cloudflare resolvers. PhishDestroy has already added the domain to its block list, and the blocklist entry confirms a credential‑phishing intent. The available evidence confirms that the domain was used for credential phishing, but the specific phishing lure, targeted brand, or compromised credentials have not been publicly disclosed because the site is currently offline.

No additional indicators such as malicious payload hashes, phishing email samples, or victim reports are available at this time. Defenders should immediately block network traffic to 172.66.44.254 and add overview-bass-ultra.pages.dev to URL filtering, DNS sinkhole, and endpoint allow‑list exclusion policies. Monitoring for new sub‑domains under the same Cloudflare account or for domains that resolve to the same IP range is advisable, as threat actors often reuse the same hosting infrastructure.