en-smartappresolver[.]pages[.]dev

Analysis of en-smartappresolver.pages.dev indicates that the domain is being leveraged in an active generic phishing campaign. The domain was registered on January 06, 2025 through Cloudflare Pages, a service that provides server‑less hosting and automatically assigns Cloudflare‑managed IP addresses. DNS resolution points to 188.114.96.3, an IP address owned by Cloudflare, confirming the hosting infrastructure. The site has been flagged by PhishDestroy and appears on one external security blocklist, demonstrating that at least one security community has taken mitigation steps.

VirusTotal scans show that 12 of 91 security vendors have raised detections against the domain, providing additional corroboration of malicious intent. No public SSL certificate details, HTTP status codes, or page title information are currently available, limiting visibility into the exact content served. The evidence base therefore consists of registration metadata, hosting IP, blocklist presence, and multi‑vendor detection counts. Defenders should prioritize adding en-smartappresolver.pages.dev to URL filtering rules and block the associated IP address 188.114.96.3 at the network perimeter.

Continuous monitoring of Cloudflare‑issued IP ranges for new domains exhibiting similar detection patterns is advised. Organizations using security‑aware browsers should ensure safe‑browsing services are enabled, as they are likely to flag the domain based on existing vendor detections. Because the domain’s content has not been publicly dissected, further investigation of the live site, if safely sandboxed, would be required to identify any credential‑harvesting forms or additional payloads. Until such analysis is completed, the domain should be treated as high‑risk and excluded from user‑facing traffic.