revokes-aerocom[.]pages[.]dev

The domain revokes-aerocom.pages.dev is currently active and has been classified as a high‑risk generic phishing operation. Infrastructure analysis shows the domain is registered through Cloudflare, Inc., and resolves to the IP address 172.66.44.219, which is hosted on Cloudflare’s edge network. The authoritative nameservers are ashton.ns.cloudflare.com and nancy.ns.cloudflare.com, confirming the use of Cloudflare’s DNS services. Google Safe Browsing has flagged the site for social engineering, indicating that the URL is likely being used to harvest credentials or otherwise deceive users.

VirusTotal analysis reports that nine out of ninety‑one security vendors have flagged the domain, providing additional corroboration of malicious intent. The domain appears on four external security blocklists and is explicitly blocked by PhishDestroy, MetaMask, ScamSniffer, and SEAL, demonstrating consensus among multiple threat‑intelligence providers. No page title, brand target, or specific scam kit information is available in the current intelligence, so the precise content and impersonated brand remain unknown.

Defenders should prioritize blocking the domain at network perimeter devices, DNS resolvers, and endpoint security solutions. Continuous monitoring of the IP address and associated Cloudflare infrastructure is advised, as attackers may shift hosting or create additional sub‑domains under the same provider. Organizations should also update URL filtering policies to include revokes-aerocom.pages.dev and remain vigilant for any future indicators that could reveal the specific victim‑targeted services or credential‑harvesting techniques employed by this site.