apple-suport[.]pages[.]dev

The domain apple-suport.pages.dev was observed in active status on 2026-07-29 and is classified as a generic phishing infrastructure. Registration information indicates the domain was provisioned through Cloudflare, Inc., using the authoritative name servers hasslo.ns.cloudflare.com and uma.ns.cloudflare.com. DNS resolution points to the IP address 188.114.96.3, which belongs to the Cloudflare network and is commonly leveraged for fast‑flux or malicious hosting. The domain appears on one public security blocklist and has been explicitly blocked by the PhishDestroy sinkhole, confirming that it is being used for malicious credential harvesting.

VirusTotal analysis shows that seven of ninety‑one scanned security vendors flagged the domain, providing independent corroboration of its malicious nature. No additional public threat‑intel sources such as OTX or Google Safe Browsing were cited in the supplied data, and no page‑title or SSL certificate details have been released, leaving the exact content of the hosted page unknown. The limited detection count suggests that the site may be employing evasion techniques or that it is relatively new, but the presence of multiple vendor detections and a dedicated blocklist entry indicates a non‑trivial risk to users. Defenders should add 188.114.96.3 and the fully qualified domain name to outbound filtering rules, enforce DNS sinkholing for the domain, and monitor Cloudflare‑owned IP ranges for anomalous traffic patterns.

Endpoint protection solutions that incorporate the VirusTotal detection signatures should be updated to reflect the seven vendor flags. Continuous re‑scanning of the domain is advised, as the lack of publicly available page metadata limits the ability to assess the specific phishing lure employed. Until further forensic evidence is collected, the domain should be treated as a confirmed phishing host with elevated risk.