babytrumpmeme[.]pages[.]dev

Analysis indicates that the domain babytrumpmeme.pages.dev is actively hosting a brand‑impersonation page targeting the Trump Token brand. The site was registered on May 09 2026 through Cloudflare Pages and resolves to the Cloudflare edge address 188.114.97.3, which is geolocated to Canada and associated with Cloudflare, Inc. The site presents a TLS certificate issued by Google Trust Services under the WE1 root, confirming the use of a valid HTTPS connection. HTTP requests return a 200 status and the page title is “SolToken”, which does not match the claimed brand and suggests a potential lure for cryptocurrency‑related victims. The domain appears on one security blocklist and has been flagged by PhishDestroy. Independent scanning on VirusTotal shows six of ninety‑two security vendors marking the domain as malicious, indicating modest detection coverage. The Gridinsoft trust score of 0 / 100 further reflects a low reputation. The infrastructure appears to be a newly created, short‑lived deployment typical of opportunistic impersonation campaigns. Uncertainty remains regarding the exact payload or credential‑harvesting mechanisms, as the page content has not been examined. Defenders should block resolution to 188.114.97.3, add the domain to URL filtering policies, and monitor for related traffic to Cloudflare Pages subdomains. Continuous re‑scanning on multi‑engine services is recommended to capture any evolving indicators.