pocketnet[.]pages[.]dev

The domain pocketnet.pages.dev was observed on 2026‑08‑02 as part of an active generic phishing campaign identified by the seed 4015cc. VirusTotal records show that the host was submitted to 91 antivirus and URL‑reputation engines, yet none of the scanners raised a detection at the time of analysis. The same host appears on a single external blocklist and is explicitly blocked by the PhishDestroy service, indicating that at least one independent anti‑phishing organization has classified the domain as malicious. No additional public intelligence such as Google Safe Browsing, OTX, or registrar‑level abuse records is currently available for this host.

Likewise, details about the hosting provider, IP address, ASN, SSL certificate, HTTP response code, or page title have not been disclosed in the present dataset. Because the domain is hosted under the pages.dev sub‑domain, it benefits from the automatic TLS termination provided by the underlying service, which may lend an appearance of legitimacy despite the lack of a dedicated certificate. The absence of detections does not imply safety; phishing actors often employ fresh or low‑profile infrastructure that evades automated signatures while still delivering credential‑stealing pages.

Defenders should therefore add pocketnet.pages.dev to outbound‑web filtering rules, ensure it is blocked in DNS‑level threat feeds, and monitor any future submissions to reputation services for changes in detection status. Continuous observation of the associated sub‑domain namespace is advisable, as attackers frequently generate additional sibling domains that share the same hosting environment. Organizations that enforce multi‑factor authentication and user education on unsolicited login requests will reduce the impact of potential credential harvest attempts originating from this domain.