the-navi-net[.]pages[.]dev

The-navi-net.pages.dev was identified on 25 July 2026 as a credential‑phishing site. The domain was registered through Cloudflare, Inc. on 21 February 2026 and resolves to the IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. in the United States. The host presents a Google Trust Services / WE1 SSL certificate, indicating that TLS termination is performed by Cloudflare. HTTP requests return a 403 status code, and the service advertises HSTS and HTTP/3 support, confirming the use of modern Cloudflare edge features. Nameserver records point to lucy.ns.cloudflare.com and jay.ns.cloudflare.com, consistent with the registrar information.

VirusTotal analysis shows that six of ninety‑three scanning engines flagged the domain, reinforcing the suspicion of malicious activity. The site appears on a single public blocklist and is actively blocked by PhishDestroy. Gridinsoft assigns a trust score of zero out of one hundred, reflecting a high confidence of abuse. The page title returned by the server is “Suspected phishing site | Cloudflare”, which is a generic warning page supplied by Cloudflare when a domain is taken down for policy violations. The current status is listed as offline, and no further content is reachable for inspection.

At present, the exact phishing payload, target brand, or credential collection mechanism remains unknown because the site is no longer serving content. Analysts should therefore treat the domain as a confirmed credential‑phishing indicator and enforce network‑level blocks wherever possible. Adding the domain to internal URL filtering lists, sharing the indicator with threat‑intel platforms, and monitoring the associated IP address for future re‑use are recommended. Continuous observation of Cloudflare‑hosted domains that share the same nameservers or ASN may help detect re‑deployment of similar phishing infrastructure.