naviso[.]pages[.]dev

Analysis as of July 24 2026 indicates that naviso.pages.dev was registered on February 21 2026 through Cloudflare, Inc. The domain resolves to IP address 172.66.47.106, an AS13335 Cloudflare node located in the United States. The TLS certificate presented is issued by Google Trust Services under the WE1 CA, which is consistent with legitimate Cloudflare services. HTTP responses return a 403 status and the page title reported by the scanner is “Suspected phishing site | Cloudflare”, directly referencing the targeted brand. Infrastructure fingerprints show the use of HSTS, Cloudflare caching, and HTTP/3, all typical of Cloudflare‑hosted sites. Reputation metrics are extremely poor: the Gridinsoft trust score is 0 out of 100 and the domain appears on one external blocklist.

VirusTotal analysis shows five of ninety‑three scanning engines flag the domain, reinforcing the malicious classification. The nameservers listed are olof.ns.cloudflare.com and carla.ns.cloudflare.com, both owned by Cloudflare. The site has been categorized as a brand‑impersonation campaign targeting Cloudflare and has been blocked by PhishDestroy. At the time of assessment the site is offline. Defenders should immediately add naviso.pages.dev to network‑level deny lists and configure DNS filtering to drop queries for the domain.

Because the domain is hosted on Cloudflare’s infrastructure, generic cloud‑provider blocks may cause collateral impact; therefore, rule creation should be scoped to the exact FQDN. Continuous monitoring of the associated IP address and the two Cloudflare nameservers is advised to detect any re‑registration or shift to new subdomains. Security teams should also review any internal logs for outbound connections to 172.66.47.106 or HTTPS requests bearing the “Suspected phishing site | Cloudflare” title, as these may indicate successful phishing attempts before takedown.