begin-logn-support-cnbase[.]pages[.]dev

The domain begin-logn-support-cnbase.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and is hosted on a Cloudflare edge node (IP 172.66.47.61, AS13335, United States). The site presented the page title "Suspected phishing site | Cloudflare" and returned an HTTP 403 response before being taken offline. Technical fingerprints include HSTS, Cloudflare services, and HTTP/3 support, with the TLS certificate issued by Google Trust Services (WE1).

Security telemetry shows the domain appears on a single blocklist and has been flagged by PhishDestroy. Google Safe Browsing lists it as a social‑engineering threat, and VirusTotal recorded 13 of 95 security vendors marking the domain as malicious. The Gridinsoft trust score is 0 out of 100, reinforcing the high‑risk assessment.

The identified scam type is brand impersonation, though the specific brand targeted is not disclosed in the available data. Defenders should immediately add the domain to URL filtering and endpoint allow‑list exclusions, enforce blocking of the associated Cloudflare IP range where practical, and monitor for any re‑use of the same hostnames or similar sub‑domain patterns. Given the recent creation date and reliance on Cloudflare’s infrastructure, threat actors may attempt to replicate this setup under new domains; continuous threat‑intel feeds and periodic re‑scans of related Cloudflare‑hosted assets are recommended to detect resurgence.