ivrpromo[.]pages[.]dev

This domain, ivrpromo.pages.dev, is flagged as an active phishing infrastructure targeting users through a fraudulent IVR Promo Network scheme. Registered on April 1, 2026, via Cloudflare, Inc., the domain resolves to the IP address 188.114.96.3 and is currently operational. Infrastructure analysis reveals the use of Cloudflare hosting, HTTP/3, and a Let's Encrypt SSL certificate, which are common among both legitimate and malicious sites but do not mitigate the threat in this case. The page title, 'IVR Promo Network,' suggests an attempt to impersonate or exploit interactive voice response (IVR) promotional services, though the exact content and targeting methods remain unconfirmed due to limited public analysis. The domain appears on one security blocklist and has been assigned a trust score of 0/100 by Gridinsoft, indicating high-risk classification. One of 95 security vendors on VirusTotal has flagged the domain, though this single detection does not provide conclusive evidence of its malicious nature. Technologies detected include HSTS and Google AdSense, which may be leveraged to lend an appearance of legitimacy or to monetize traffic generated through phishing activities. Defenders should treat this domain as hostile infrastructure and block it at the network level. Further investigation is recommended to determine the scope of the campaign, including any associated email or SMS vectors, and to identify potential victims. Given the domain's recent registration and active status, monitoring for additional indicators of compromise is advised.