4ba67ccf[.]vivewss[.]pages[.]dev

Analysis of the domain 4ba67ccf.vivewss.pages.dev confirms its classification as a credential phishing site, now offline as of July 23, 2026. Infrastructure analysis reveals the domain was hosted on Cloudflare's network, resolving to IP 188.114.96.3 (AS13335, US), a common pattern for rapidly deployed phishing pages leveraging Cloudflare's CDN and security features. The domain was registered through Cloudflare Pages, a platform frequently abused for hosting malicious content due to its ease of deployment and ephemeral nature. The HTTP status returned a 403 Forbidden response, consistent with Cloudflare's automated intervention for suspected phishing activity, as indicated by the page title 'Suspected phishing site | Cloudflare.' Security vendor detections further support the phishing classification: 13 of 95 engines on VirusTotal flagged the domain, and it appears on at least one security blocklist (PhishDestroy).

The domain's Gridinsoft trust score of 0/100 aligns with these findings. SSL certificate analysis shows the domain used a Google Trust Services certificate (WE1), a common but not exclusive indicator of legitimate infrastructure repurposed for malicious use. Technologies detected include HSTS and HTTP/3, which are standard for Cloudflare-hosted sites but do not mitigate the domain's malicious intent. No nameservers were found for the domain, suggesting it may have been configured for short-term use or was taken down before full DNS propagation.

The scam type is explicitly identified as credential phishing, though the specific brand or service targeted is not detailed in available evidence. Defenders should treat this domain as confirmed malicious, block it at the network level, and monitor for related infrastructure using the same IP range or registrar. Given its offline status, further forensic analysis may be limited, but historical logs should be reviewed for connections to this domain.