services-email-naviplus-app[.]pages[.]dev

This domain, services-email-naviplus-app.pages.dev, operates as a credential harvesting phishing site targeting users of NaviPlus email services. The site presents itself as a legitimate portal for NaviPlus Email Templates, designed to trick visitors into entering sensitive login credentials, such as usernames, passwords, or other authentication details. Once submitted, this information is captured by threat actors and can be used for unauthorized account access, financial fraud, or further targeted attacks against individuals or organizations associated with NaviPlus. Analysis indicates multiple technical indicators supporting the classification of this domain as malicious. The domain was registered on November 21, 2025, through Cloudflare, Inc., and currently resolves to the IP address 198.18.2.124, hosted on Cloudflare’s infrastructure (AS13335). Security vendors have flagged this domain, with 2 out of 95 engines on VirusTotal detecting it as malicious. Additionally, it appears on one security blocklist and lacks an SSL certificate, a common red flag for phishing sites that fail to implement basic security measures. The absence of encryption increases the risk of data interception during transmission, further compromising user security. Users who have visited services-email-naviplus-app.pages.dev or entered credentials on the site should take immediate action to mitigate potential risks. First, change any passwords or authentication details that may have been exposed, prioritizing accounts linked to NaviPlus or other critical services. Enable multi-factor authentication (MFA) wherever possible to add an additional layer of security. Monitor accounts for suspicious activity, such as unauthorized logins or transactions, and report any anomalies to the relevant service providers. If corporate or organizational credentials were compromised, notify the IT or security team to initiate incident response protocols. Finally, consider scanning devices for malware or unauthorized access, as phishing sites may deploy additional payloads to maintain persistence or exfiltrate further data.