narvax-biz-pelqor-282620[.]pages[.]dev

This domain, narvax-biz-pelqor-282620.pages.dev, is identified as a credential harvesting site specifically designed to impersonate Microsoft authentication portals. Analysis indicates the infrastructure was actively used to deceive users into submitting login credentials, likely for account compromise or subsequent fraudulent activities. The site has since been taken offline, but prior activity warrants further scrutiny. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on April 29, 2026, and resolved to the IP address 188.114.97.3, located in Canada under Cloudflare’s network. The SSL certificate was issued by Let’s Encrypt (serial number E8), a common choice for malicious actors due to its free and automated issuance process. The domain appears on one security blocklist and was flagged by 18 of 95 security vendors on VirusTotal, indicating a moderate-to-high confidence level in its malicious nature. Additional indicators include its classification as a suspected phishing site by Cloudflare’s internal systems, further corroborating its fraudulent purpose. As of the latest assessment, narvax-biz-pelqor-282620.pages.dev has been rendered inaccessible, likely due to enforcement actions by the hosting provider or security teams. Organizations and users are advised to treat any prior interactions with this domain as compromised. Network administrators should review logs for connections to 188.114.97.3 and monitor for credential reuse attempts. End-users who may have entered credentials on this site should immediately reset passwords for associated accounts and enable multi-factor authentication where available. Proactive monitoring for similar domains leveraging Cloudflare Pages infrastructure is recommended to mitigate future risks.