invicing-com[.]pages[.]dev

invicing-com.pages.dev is an active domain registered on March 24, 2026 through a DNS provider that also supplies CDN services. The domain resolves to IP address 188.114.97.3, which geolocates to Canada and is associated with a known CDN operator. The site presents the title “Invicing | Secure PayPal Invoicing for Teams,” directly referencing PayPal, and is classified as a brand‑impersonation campaign targeting PayPal users. Technical analysis shows the server returns an HTTP 301 redirect and supports HTTP/3. The SSL certificate is issued by Google Trust Services under the WE1 intermediate, indicating proper TLS termination. The domain appears on one security blocklist and has a Gridinsoft trust score of 0 out of 100, reinforcing its malicious reputation. It has been blocked by PhishDestroy and is currently listed as active under investigation. No detections were reported by VirusTotal at the time of scanning, but the absence of detections does not constitute evidence of safety. Defenders should add the domain and its resolving IP to deny‑list rules, monitor DNS queries for similar Cloud‑hosted patterns, and consider broader blocks of newly created domains that reference PayPal in page titles. Ongoing observation is required to detect any future payload delivery or credential‑harvesting pages that may be deployed behind the current redirect.