run-gateway[.]pages[.]dev

This domain, run-gateway.pages.dev, is currently under investigation for generic phishing activity targeting user credentials or sensitive information. Analysis indicates the domain is active and has not yet been flagged by security vendors for malicious behavior. The infrastructure is hosted through a content delivery network provider, which is commonly exploited to evade detection and maintain operational persistence. Technical indicators reveal the domain is registered under Cloudflare, Inc., and resolves to the IP address 188.114.96.3. As of the latest scan, the domain has been flagged by 0 of 95 VirusTotal vendors, suggesting it has not yet been widely recognized as malicious. No historical blocklist records or trust score degradations were observed in public threat intelligence feeds. The lack of detection may indicate either a newly deployed campaign or the use of evasion techniques to bypass automated analysis systems. Current risk assessment categorizes this domain as under investigation due to its active status and unresolved threat classification. Organizations are advised to implement temporary network-level blocking for run-gateway.pages.dev and its associated IP address, 188.114.96.3, pending further analysis. Security teams should monitor endpoint logs for connections to this domain and investigate any user reports of unexpected redirects or credential prompts. If brand impersonation is confirmed, affected entities should be notified to initiate takedown procedures. Continuous monitoring of threat intelligence feeds for updates on this domain is recommended to adjust defensive measures as new evidence emerges.