raratravel[.]pages[.]dev

This domain is flagged as a high-risk generic phishing site impersonating a travel brand. The domain was registered on April 22, 2026, through Cloudflare, Inc., and remains active as of July 12, 2026. It resolves to IP 188.114.96.3, hosted on Cloudflare infrastructure (ASN not specified, location CA). The page title indicates a travel service named 'RARA TRAVEL & TOUR' operating in the Jember, Malang, Surabaya region. Technical analysis shows the site uses HSTS, HTTP/3, and a valid SSL certificate from Google Trust Services. The nameservers are stan.ns.cloudflare.com and tricia.ns.cloudflare.com. VirusTotal reports 1 out of 94 security vendors flagging this domain as malicious. The Gridinsoft trust score is 0/100, and it appears on one security blocklist (PhishDestroy). The specific phishing mechanism or brand being impersonated beyond the travel name is not detailed in available intelligence. Defenders should block the domain at the network level, monitor for related subdomains or variations under pages.dev, and educate users about unsolicited travel booking offers. The exact content of the page has not been analyzed, so visual or form-based indicators remain unknown. Given the low trust score and vendor detections, this domain should be treated as actively hostile.