safe-badge-support-page-00026world[.]pages[.]dev

The domain safe-badge-support-page-00026world.pages.dev is currently active and engaged in brand impersonation targeting Cloudflare. Analysis confirms this infrastructure is designed to harvest credentials by presenting fraudulent login interfaces under the guise of legitimate service authentication portals. The site remains accessible and continues to pose a high-risk threat to users who may mistake it for an official Cloudflare support or account verification page. Infrastructure analysis reveals the domain was provisioned through Cloudflare, Inc. and resolves to the IP address 188.114.97.3. The site employs HSTS and HTTP/3 protocols, with an SSL certificate issued by Google Trust Services, creating an appearance of legitimacy. However, the domain has been flagged by 10 of 95 security vendors on VirusTotal, indicating detection of malicious intent. The page title, 'Suspected Phishing | Cloudflare,' further corroborates the fraudulent nature of the site, as it directly references the impersonated brand while signaling phishing activity. Current status remains active, with no evidence of takedown or mitigation at the time of assessment. Organizations and users are advised to block the domain and IP address at the network perimeter. Security teams should update detection rules to include this infrastructure in phishing and brand impersonation signatures. End users should verify domain authenticity before entering credentials, particularly when prompted by unsolicited links or unexpected login requests. Monitoring for similar subdomain patterns under the pages.dev namespace is recommended to identify potential follow-on threats.