secure-cnbase-com-signin[.]pages[.]dev

Analysis indicates that the domain secure-cnbase-com-signin.pages.dev was registered on 21 February 2026 through Cloudflare, Inc. and is hosted on Cloudflare's network (ASN 13335) with the IP address 188.114.97.3 located in the United States. The domain resolves to a Cloudflare‑provided IP and uses the standard Cloudflare edge infrastructure, including HSTS enforcement and HTTP/3 support. The TLS certificate presented is issued by Google Trust Services under the WE1 root, which is typical for Cloudflare‑proxied sites and does not, by itself, guarantee legitimacy. The page title returned by the server is "Suspected phishing site | Cloudflare", a default warning page used by Cloudflare when a site is flagged for malicious activity. The site has been classified as a credential phishing operation.

Evidence of this classification appears in multiple security feeds: PhishDestroy has taken the domain offline, Google Safe Browsing lists it as a social‑engineering threat, and Gridinsoft assigns a trust score of 0 out of 100. VirusTotal reports that 12 of 93 scanning engines flag the domain, reinforcing the malicious assessment. The domain appears on one external blocklist, further confirming that it is being treated as hostile by at least one security community. Because the domain is currently offline, active probing is limited to historical records. No additional payloads, redirects, or malware samples have been observed, and no brand‑specific landing page content has been disclosed in the available intelligence.

Consequently, the precise phishing vector—such as the targeted service or credential‑capture form—remains unknown. Defenders should continue to block any outbound connections to 188.114.97.3 and add secure‑cnbase‑com‑signin.pages.dev to internal blocklists. Monitoring for re‑registration or the emergence of similar sub‑domains on Cloudflare’s edge network is advisable, as the attacker may reuse the same infrastructure.