Is sweet-base-be3a.masonscott641807.workers.dev a scam or a legit website?

sweet-base-be3a.masonscott641807.workers.dev is a dangerous phishing — do not enter your login or personal details. Our review tagged it for phishing. 16 of 92 security engines flag it (16 as outright malicious). The domain is an unknown age. This pattern matches throwaway sites built to take money or data and disappear.

I already paid or entered my details on sweet-base-be3a.masonscott641807.workers.dev — what should I do?

If you've already paid or handed over details on sweet-base-be3a.masonscott641807.workers.dev, act quickly. 1) Contact your bank or card issuer immediately and ask to dispute the charge or open a chargeback — the sooner you act, the better your odds. 2) Report the site to the U.S. FTC at reportfraud.ftc.gov or the FBI's IC3 at ic3.gov, and in the UK to Action Fraud at actionfraud.police.uk. 3) If you entered a password, change it on sweet-base-be3a.masonscott641807.workers.dev and anywhere you reused it, and turn on two-factor authentication. 4) Watch your bank and email for follow-up fraud, and keep screenshots as evidence.

Can I get my money back from sweet-base-be3a.masonscott641807.workers.dev?

Often yes, if you act fast. Payments made by credit or debit card can frequently be reversed through a chargeback or dispute — contact your bank right away and explain it was a fraudulent site. Bank transfers and gift-card or voucher payments are much harder to recover, but you should still report them to your bank and to the FTC (reportfraud.ftc.gov) or Action Fraud (actionfraud.police.uk). Avoid any "refund" or "recovery" service that contacts you first — it's usually a follow-up scam.

Did sweet-base-be3a.masonscott641807.workers.dev steal my password or personal information?

If you entered anything on sweet-base-be3a.masonscott641807.workers.dev, assume it was captured. Phishing pages exist purely to harvest what you type — usernames, passwords, card numbers, or one-time codes. Change the password immediately on the real site and anywhere you reused it, enable two-factor authentication, and if you entered card or banking details, contact your bank about the risk of fraud. Also be alert for follow-up "security" calls or emails that try to exploit the same information.

How do I report sweet-base-be3a.masonscott641807.workers.dev?

You can report sweet-base-be3a.masonscott641807.workers.dev through several official channels: the U.S. FTC at reportfraud.ftc.gov, the FBI's Internet Crime Complaint Center (IC3) at ic3.gov, and — in the UK — Action Fraud at actionfraud.police.uk. You can also flag it to Google Safe Browsing (safebrowsing.google.com/safebrowsing/report_phish) so other browsers warn about it, and report it to the company being impersonated if there is one. Reporting helps get scam sites taken down faster.

sweet-base-be3a.masonscott641807.workers.dev looks professional — how can it still be a scam?

Modern scams are built to look convincing. A valid SSL padlock, a polished template, stock photos, fake reviews, and a trust badge can all be added in minutes and prove nothing about who runs the site. Scammers buy cheap domains, clone real designs, and copy legal pages wholesale. That's exactly why an automated review that checks the domain's age, hosting, blacklists, and behaviour — rather than just how the page looks — is more reliable than a first impression.

Has sweet-base-be3a.masonscott641807.workers.dev been flagged by antivirus engines?

Yes. 16 of 92 antivirus and blocklist engines in our malware network flagged sweet-base-be3a.masonscott641807.workers.dev, 16 of them as outright malicious. Even a single detection from a reputable engine is a meaningful warning, and multiple detections rarely happen by accident.

Is sweet-base-be3a.masonscott641807.workers.dev on any phishing or malware blacklists?

Yes. sweet-base-be3a.masonscott641807.workers.dev is listed on the major browser blocklist feeds under: SOCIAL_ENGINEERING. Modern browsers use these feeds to warn or block billions of users before a page even loads — a listing here is one of the strongest safety signals there is.

How old is the sweet-base-be3a.masonscott641807.workers.dev domain?

sweet-base-be3a.masonscott641807.workers.dev is an unknown age. A multi-year registration history is one of the stronger signals against a scam, though it's never a guarantee on its own — established domains can still be misused.

What do other review sites say about sweet-base-be3a.masonscott641807.workers.dev?

Independent trust-rating sites currently show ScamAdviser (3/100) for sweet-base-be3a.masonscott641807.workers.dev. Those scores mix user reviews with their own automated heuristics, so they're useful to compare against our verdict — but treat any single source, including review sites that can be gamed with fake reviews, as one data point rather than the final word.

Critical Threat

Phishing site — do not log in

Flagged on major browser safety blocklists as social engineering. Do not enter credentials. Open the real service from a trusted bookmark or app.

Security Review

Is sweet-base-be3a.masonscott641807.workers.dev legit or a scam?

Critical Threat: Phishing

Recommended action:Do not enter credentials. Open the real service from a trusted bookmark or app.

This assessment combines 12 completed security checks into one public risk profile. Review the evidence and missing checks below before deciding whether to interact with sweet-base-be3a.masonscott641807.workers.dev.

Cross-checked against 12 completed checks — 3 raised a concern

Open-web research was partially available; the verdict uses the other completed checks.

Top reasons

16 of 92 antivirus engines flag the page as phishing, including BitDefender, ESET, and Fortinet.Browser blocklist feeds mark the URL for social engineering activity.Cloudflare Workers subdomain with no visible business contact information or registration.

sweet-base-be3a.masonscott641807.workers.devScanned Jul 16, 2026

Post Facebook

Risk profile

Critical Threat

Threat type: Phishing
Evidence strength: Strong
Recommended action: Do not sign in

Technical score

Legacy trust score: 1/100

Score breakdown

Heuristics 0·MT 15

Category tags

phishingHow sure we are: High

Technical red flags (3)

16 of 92 engines flaggedGoogle Safe Browsing warningLow external reputation (3/100)

Positive signals (2)

Encrypted connectionNo significant IP abuse signal

These checks passed — but they don't clear the site. Valid SSL and a calm hosting IP only show that parts of the infrastructure work normally. They do not prove the business is real or cancel the warning signals above.

View density

At a glance

The most useful evidence from this scan, separated from the final verdict so you can judge the signals yourself.

12 checks completed

Antivirus engines

16/92

Engines flagged this URL

Domain registration

—

Registration date unknown

Operator identity

Missing

No operator identity was found on the inspected page

How this report was created

Checks completed12

Open-web researchPartial

AnalysisAI-assisted synthesis

Scan timeJul 16, 2026

The public risk profile combines the completed automated checks into one consistent interpretation. A staff review is only claimed when explicitly identified on the report.

Intelligence

Advanced threat intelligence

Analysis

Critical ThreatengineMT · GuardianThreat pattern matchLimited match

MT AgentLive web researchVisual inspection

90%

Confidence

Bottom line

The URL is a workers.dev subdomain, a hosting pattern frequently used for short-lived phishing pages. The page title claims to be Meta for Business yet shows almost no content and lists no email, phone, or address. Sixteen antivirus engines, including BitDefender, ESET, and Fortinet, classify the page as phishing. Browser blocklist feeds also mark it for social engineering. The hosting IP carries no abuse history, but that does not offset the detection signals. Independent trust aggregators assign the domain a very low score of 3 out of 100. Our research found no legitimate business registration or positive mentions to counter the technical flags. The combination of a disposable subdomain, missing accountability data, and consistent malicious detections indicates the page is designed to harvest credentials.

Full analysis

Page Content

The page loads with the title "Meta for Business" and almost no other visible text or elements. No contact email, phone number, or postal address appears anywhere on the page.

Infrastructure

The site runs on Cloudflare Workers, a platform commonly abused for phishing because subdomains can be created instantly and discarded. The IP shows no prior abuse reports, yet the domain itself is not indexed in global traffic rankings.

Domain History

WHOIS details are unavailable due to the workers.dev subdomain structure. No registration age or registrar information could be retrieved.

Web Reputation

Sixteen of 92 antivirus engines flag the URL as phishing, including alphaMountain.ai, BitDefender, Criminal IP, ESET, Forcepoint ThreatSeeker, and Fortinet. Browser blocklists also categorize it as social engineering. Independent review aggregators give the domain a normalized trust score of 3 out of 100.

What This Means for You

Entering any login details or personal information on this page would send that data to an attacker. Avoid visiting the link and do not interact with any forms it may eventually display.

Evidence behind the conclusion

Risk Factors

16 of 92 antivirus engines flag the page as phishing, including BitDefender, ESET, and Fortinet.
Browser blocklist feeds mark the URL for social engineering activity.
Cloudflare Workers subdomain with no visible business contact information or registration.
Independent trust aggregators assign a very low score of 3 out of 100.
Page presents a Meta for Business title but contains almost no functional content.

Uncertainty and missing checks

Exact domain registration date unavailable for workers.dev subdomains.
Screenshot capture was incomplete, limiting visual confirmation.

Recommendation

Do not enter credentials. Open the real service from a trusted bookmark or app.

Next-gen fraud intelligence

Evidence-backedCross-checked

Website Preview

SCAN-TIME CAPTURE

sweet-base-be3a.masonscott641807.workers.dev

What our review noticed on this page

1Screenshot incomplete — site may be slow to render

Automated page render — captured in a safe sandbox. What an ordinary visitor would see when loading the site. See full visual analysis →

Visual analysis

We capture a fresh screenshot of the live page and ask a vision model to look for scam visual patterns — fake trust badges, countdown timers, overlay pop-ups, and visual clones of legitimate brands.

/ 100

High visual risk

Visual red flags detected in the screenshot

We could not capture a fully-rendered screenshot of this page; visual analysis is inconclusive.

Visual risk50/100

What our vision model saw

1 signal

Screenshot incomplete — site may be slow to render

Web Research

Findings and citations

Web research incomplete

Some claims could not be corroborated and were excluded.

The accepted cited findings are shown below. This partial result is not used to claim that no complaints or reports exist.

These are the cited findings returned by the completed web search for sweet-base-be3a.masonscott641807.workers.dev. A missing category means no cited result was retained, not that every source on the web was exhaustively checked.

Source ratings

Third-party source ratings — not the MalwareTips risk level

ScamAdviser

Source rating: 3/100

High riskopen

Key findings

4 headline facts from open-web research

Domain is a Cloudflare Workers subdomain (workers.dev)
Single sourceChecked in this scanSource
Multiple similar *.workers.dev subdomains documented in phishing and threat intelligence reports
Single sourceChecked in this scanSource
Cloudflare Workers infrastructure frequently used for phishing pages impersonating login flows
Single sourceChecked in this scanSource
Huntress and other researchers document Meta Business Manager phishing campaigns using fake login pages
Single sourceChecked in this scanSource

Research summary

Narrative write-up from our AI analyst

No scam reports or positive reviews were located in the available research.

Threat Detection

Antivirus Engines

Detection matrix · live

16 malicious detections

We cross-check every URL against our antivirus network of 92 malware and blacklist engines. The vendors below classified the URL as malicious, which is the strongest antivirus warning.

16Malicious0Suspicious45Harmless92Engines

of 92

alphaMountain.ai

Malicious· phishing

BitDefender

Malicious· phishing

Criminal IP

Malicious· phishing

ESET

Malicious· phishing

Forcepoint ThreatSeeker

Malicious· phishing

Fortinet

Malicious· phishing

G-Data

Malicious· phishing

Google Safe Browsing

Malicious· phishing

Gridinsoft

Malicious· phishing

Kaspersky

Malicious· phishing

LevelBlue

Malicious· phishing

Lionic

Malicious· phishing

Rising

Malicious· phishing

Sophos

Malicious· phishing

VIPRE

Malicious· phishing

Webroot

Malicious· malicious

16 malicious detections. A malicious classification is a strong warning. Avoid entering credentials, payment information, or downloading files.

Security Scans

Blacklist Check

This URL appears on threat lists

Detected threat categories: SOCIAL_ENGINEERING.

Sandbox Render

Page rendered in a safe sandbox

Requests made0

Unique IPs2

Countries1

Detected brandsNone

What this means: we opened the page inside a locked-down browser and watched what it tried to load. This is context for the checks above — not a verdict on its own.

Reputation Sources

How this domain rates across independent threat-intelligence and blocklist providers.

Google Safe Browsing

ListedCheck ↗

VirusTotal

ListedCheck ↗

AbuseIPDB

Not listedCheck ↗

Also verify:Spamhaus ↗DNSBL / SURBL ↗PhishTank ↗

Threat Pattern Match

1 threat patterns detected

Threat Pattern Match

1 of 21 categories showed signals

We check every URL against 21 distinct threat categories to identify what kind of pattern is present. This match is not a second risk level. Each meter pulls from page signals, web reports, our AI analyst, vision, and the scam-network cluster — not from raw AV labels.

Top match: Phishing

Phishing

Pattern match: Moderate

35/100

Google Safe Browsing flagged this as social engineering / phishing.
AI analyst tagged this as phishing / data-harvesting.

Threat Pattern Match

1 of 21 categories showed signals

Top match: Phishing

Phishing

Pattern match: Moderate

35/100

Google Safe Browsing flagged this as social engineering / phishing.
AI analyst tagged this as phishing / data-harvesting.

Technical Details

domain · encryption · redirects · server reputation · referenced

The plumbing behind the site — who registered it, how it’s encrypted, where it’s hosted, and where it links out. A valid certificate or a calm server doesn’t mean the business is honest — scam sites pass these checks too. Use this to corroborate the verdict, not to overturn it.

Identity

We fetched the page and looked for real-world contact details. Legitimate businesses almost always publish an email on their own domain, a phone number, and a postal address. Scam shops usually don't.

What We Found

No clear contact details on the page

Emails on site's domainNone

Phone numbersNone

Postal addressNot listed

Linked social profiles0

Signal Summary

Several contact red flags

No contact email found anywhere on the page.
No phone number listed on the page.
No postal address visible on the page.

Domain

Domain History

AgeUnknown

RegistrarHidden

RegisteredUnknown

ExpiresUnknown

Owner privacyVisible

Encryption Certificate

StatusValid

ProtocolTLSv1.3

IssuerGoogle Trust Services · WE1

ExpiresOct 13, 2026 (88d)

Self-signedNo

Hosting & Technology

HostingCloudflare, Inc.

Server locationUS

Web servercloudflare

Infrastructure

Hosting

CountryUnknown

NetworkCLOUDFLARENET - Cloudflare, Inc., US

IP address188.114.96.3

Abuse Intelligence

Confidence score0%

Reports on file0

ISPCloudflare, Inc.

Usage typeContent Delivery Network

What to do

Before interacting

Do not enter credentials. Open the real service from a trusted bookmark or app.

What this means for you

You were probably about to log in or type personal details here.

Anything you enter — username, password, card number, one-time code — goes straight to criminals, who use it to take over your real accounts and drain them.

How this scam works

The trap, step by step

They clone a real login page (a bank, email provider, PayPal, a courier) pixel-for-pixel.
You're driven here by an email, text, or ad with an urgent reason to “verify”, “unlock”, or “confirm” your account.
You type your username and password — which flow straight to the scammers instead of the real company.
They log into your real account, change the password, and drain it or sell the access.

Recognising the pattern is the best defence — if a site follows these steps, close it and don't enter anything.

If you already paid, signed in or downloaded

Act promptly and follow the steps that match what you shared or opened.

Phishing site — act fast

This page shows signs of attempting to steal credentials or impersonate a trusted brand.

Do not interact with sweet-base-be3a.masonscott641807.workers.dev
Do not enter credentials, deposit money, download files, or install browser extensions from this site.
If you already typed your password — change it now
Change the password on the legitimate site and anywhere else you re-used it. Turn on two-factor authentication. Review recent account activity.
Report the phishing URL
APWG (Anti-Phishing Working Group) accepts phishing reports at reportphishing@apwg.org. Google Safe Browsing reports help protect other users.
Open
Get help on the forum
MalwareTips members can help you assess damage and next steps.
Open

Final Verdict

Threat type

Phishing

Evidence strength

Strong

Technical score

Legacy trust score: 1/100

Final Verdict·sweet-base-be3a.masonscott641807.workers.dev

Critical Threat

Why we rated sweet-base-be3a.masonscott641807.workers.dev critical threat

sweet-base-be3a.masonscott641807.workers.dev is rated Critical Threat for phishing, with strong evidence.

Do not enter credentials. Open the real service from a trusted bookmark or app.

AV engines

Domain age

—

Flagged

Scan another URL

Security review completemalwaretips.com/url-scan

Safety FAQ

Common questions, answered directly from the scan data above — so the answers always reflect the latest verdict on this page.

Before using the site

sweet-base-be3a.masonscott641807.workers.dev is a dangerous phishing — do not enter your login or personal details. Our review tagged it for phishing. 16 of 92 security engines flag it (16 as outright malicious). The domain is an unknown age. This pattern matches throwaway sites built to take money or data and disappear.
sweet-base-be3a.masonscott641807.workers.dev is rated Critical Threat for phishing, with strong evidence. Do not enter credentials. Open the real service from a trusted bookmark or app.
You can report sweet-base-be3a.masonscott641807.workers.dev through several official channels: the U.S. FTC at reportfraud.ftc.gov, the FBI's Internet Crime Complaint Center (IC3) at ic3.gov, and — in the UK — Action Fraud at actionfraud.police.uk. You can also flag it to Google Safe Browsing (safebrowsing.google.com/safebrowsing/report_phish) so other browsers warn about it, and report it to the company being impersonated if there is one. Reporting helps get scam sites taken down faster.
Modern scams are built to look convincing. A valid SSL padlock, a polished template, stock photos, fake reviews, and a trust badge can all be added in minutes and prove nothing about who runs the site. Scammers buy cheap domains, clone real designs, and copy legal pages wholesale. That's exactly why an automated review that checks the domain's age, hosting, blacklists, and behaviour — rather than just how the page looks — is more reliable than a first impression.
Yes. sweet-base-be3a.masonscott641807.workers.dev is listed on the major browser blocklist feeds under: SOCIAL_ENGINEERING. Modern browsers use these feeds to warn or block billions of users before a page even loads — a listing here is one of the strongest safety signals there is.
Independent trust-rating sites currently show ScamAdviser (3/100) for sweet-base-be3a.masonscott641807.workers.dev. Those scores mix user reviews with their own automated heuristics, so they're useful to compare against our verdict — but treat any single source, including review sites that can be gamed with fake reviews, as one data point rather than the final word.

After an incident

If you've already paid or handed over details on sweet-base-be3a.masonscott641807.workers.dev, act quickly. 1) Contact your bank or card issuer immediately and ask to dispute the charge or open a chargeback — the sooner you act, the better your odds. 2) Report the site to the U.S. FTC at reportfraud.ftc.gov or the FBI's IC3 at ic3.gov, and in the UK to Action Fraud at actionfraud.police.uk. 3) If you entered a password, change it on sweet-base-be3a.masonscott641807.workers.dev and anywhere you reused it, and turn on two-factor authentication. 4) Watch your bank and email for follow-up fraud, and keep screenshots as evidence.
Often yes, if you act fast. Payments made by credit or debit card can frequently be reversed through a chargeback or dispute — contact your bank right away and explain it was a fraudulent site. Bank transfers and gift-card or voucher payments are much harder to recover, but you should still report them to your bank and to the FTC (reportfraud.ftc.gov) or Action Fraud (actionfraud.police.uk). Avoid any "refund" or "recovery" service that contacts you first — it's usually a follow-up scam.
If you entered anything on sweet-base-be3a.masonscott641807.workers.dev, assume it was captured. Phishing pages exist purely to harvest what you type — usernames, passwords, card numbers, or one-time codes. Change the password immediately on the real site and anywhere you reused it, enable two-factor authentication, and if you entered card or banking details, contact your bank about the risk of fraud. Also be alert for follow-up "security" calls or emails that try to exploit the same information.

Technical questions

Yes. 16 of 92 antivirus and blocklist engines in our malware network flagged sweet-base-be3a.masonscott641807.workers.dev, 16 of them as outright malicious. Even a single detection from a reputable engine is a meaningful warning, and multiple detections rarely happen by accident.
sweet-base-be3a.masonscott641807.workers.dev is an unknown age. A multi-year registration history is one of the stronger signals against a scam, though it's never a guarantee on its own — established domains can still be misused.
sweet-base-be3a.masonscott641807.workers.dev resolves to an IP operated by Cloudflare, Inc. in US (Content Delivery Network). Hosting location alone doesn't make a site good or bad — but hosting that doesn't match a brand's claimed country, or that sits on networks known for abuse, is one of the many signals we weigh alongside the verdict above.

Recently scanned

Other Dangerous reports

Browse all reports

Dangeroustrust1

rfefrgdgfddf.duckdns.org

Jul 17, 2026

trezarsuit-en.wasmer.app

Jul 17, 2026

Read the review

Dangeroustrust1

mail.mmma.rumahsakit.de

Jul 17, 2026

Read the review

Dangeroustrust1

mail.sywsywml.rumahsakit.de

Jul 17, 2026

Read the review

Dangeroustrust1

wmail-web-zimbra-authenticator-4ae.netlify.app

Jul 17, 2026

Read the review

Dangeroustrust1

bright-concha-4e6328.netlify.app

moonpay-commerce-r1qbys462-heliofi.vercel.app

Jul 16, 2026

Read the review

Dangeroustrust1

moonpay-commerce-3l3h0x6ae-heliofi.vercel.app

Jul 16, 2026

Read the review

Dangeroustrust1

facebooklogin17.blogspot.com

Jul 16, 2026

Read the review

Dangeroustrust1

us-exedos-net.pages.dev

Jul 16, 2026

Read the review

Community review

User reviews & comments(0)

Share your experience — "Lost $200 on a fake checkout" is more useful than "Scam". Your review helps others avoid traps.

Loading…

Loading comments…

This report is generated automatically by combining threat intelligence, domain signals, and an AI security analyst. It is informational, not legal advice. Always use your own judgement before sharing personal information or money online.