ave-protcol-eng-us[.]pages[.]dev

On 2026-07-29 the domain ave-protcol-eng-us.pages.dev was observed in active generic phishing activity. The domain is hosted on Cloudflare's infrastructure, as indicated by its registration through Cloudflare, Inc. and the authoritative nameservers carrera.ns.cloudflare.com and frank.ns.cloudflare.com. DNS resolution returns the IPv4 address 188.114.96.3, which belongs to Cloudflare’s edge network.

The domain has been submitted to VirusTotal and examined by 91 independent scanners; none of the scanners currently report a detection, but the absence of detections does not constitute a safety assurance. Threat intelligence sources list the domain on a single security blocklist and it is explicitly blocked by the PhishDestroy service, confirming that at least one external sink has identified malicious use. No additional public reputation services, Safe Browsing checks, or Open Threat Exchange (OTX) entries were supplied, and the page title or landing‑page content has not been disclosed, leaving the precise phishing lure undefined.

Analysts therefore consider the infrastructure evidence sufficient to flag the domain as malicious, while the lack of content analysis introduces uncertainty regarding the specific credential‑ harvesting technique employed. Defensive recommendations include adding the domain and its resolved IP address to network‑level deny lists, enforcing DNS‑level filtering for the .pages.dev sub‑domain, and monitoring for any new indicators that may appear in future scans. Continuous re‑evaluation is advised should additional telemetry, such as payload samples or user‑reporting, become available.