arc-invoice[.]pages[.]dev

The domain arc-invoice.pages.dev was registered on June 04, 2026 through Cloudflare Pages and resolves to the IP address 188.114.97.3. Google Safe Browsing has flagged the site for social engineering, and the domain appears on three external blocklists. It is actively blocked by the PhishDestroy, MetaMask, and SEAL threat intelligence feeds. VirusTotal analysis shows that nine of ninety-one security vendors have raised detections against the domain, indicating a non‑trivial level of malicious activity.

The available data does not include a page title, SSL certificate details, or explicit information about the targeted brand, so the precise content of the hosted pages remains unknown. However, the combination of Safe Browsing classification, multiple blocklist listings, and vendor detections is consistent with a high‑risk generic phishing operation. Defenders should add arc-invoice.pages.dev to deny‑list rules in firewalls, DNS filters, and email security gateways.

Network monitoring should alert on any outbound connections to the IP 188.114.97.3, and endpoint protection solutions should be configured to block URLs containing the domain. Continuous re‑evaluation is advised, as further crawling or sandbox analysis could reveal additional indicators such as payloads, credential‑stealing forms, or malicious redirects. Until more detailed page content is observed, the domain should be treated as a high‑confidence phishing threat and blocked across enterprise defenses.