shedbaseinstallationnearme[.]pages[.]dev

Analysis of shedbaseinstallationnearme.pages.dev shows an elevated‑risk infrastructure that has been taken offline as of the report date, July 24 2026. The domain, created on 13 December 2025 and registered through Cloudflare, resolves to the IP address 172.66.44.68, which is owned by AS13335 Cloudflare, Inc. and geolocated to the United States. The site presents a valid SSL certificate issued by Google Trust Services under the WE1 root, and the hosting stack includes HSTS, Cloudflare services, and HTTP/3 support. HTTP requests to the domain return a 403 status code, indicating that the server is actively refusing access.

Security telemetry reports that eleven of ninety‑five VirusTotal scanners have flagged the domain, and it appears on a single external blocklist. PhishDestroy has explicitly blocked the domain, and Gridinsoft assigns it a trust score of zero out of one hundred, reinforcing the perception of malicious intent. The page title returned by the server is "Shed Base Installation Near Me," which does not appear to be related to any legitimate brand. However, the intelligence indicates the campaign masquerades as the brand "Across" and is classified as a crypto‑scam, suggesting attempts to lure victims into cryptocurrency‑related fraud.

Defenders should continue to block the domain at perimeter defenses, monitor the associated IP for any re‑activation, and include the domain in threat‑intel feeds that reference the "Across" impersonation pattern. Since the site is offline, active harvesting is not observed, but the infrastructure remains usable for future campaigns. Ongoing observation of the IP address, associated Cloudflare nameservers (sergi.ns.cloudflare.com and thea.ns.cloudflare.com), and any resurgence of the domain in DNS or SSL telemetry is recommended to pre‑empt re‑use.