business-for-clarvion[.]pages[.]dev

Analysis of the domain business-for-clarvion.pages.dev indicates it was actively involved in a credential phishing campaign prior to being taken offline on or before July 23, 2026. The domain was registered through Cloudflare, Inc. on February 21, 2026, and resolved to the IP address 188.114.97.3, which is part of AS13335 (Cloudflare, Inc.) and geolocated in the United States. Infrastructure analysis reveals the use of Cloudflare nameservers (dana.ns.cloudflare.com and coby.ns.cloudflare.com), alongside HTTP/3 and HSTS technologies, suggesting an attempt to enhance perceived legitimacy and security. The domain was flagged by 16 of 95 security vendors on VirusTotal, though the specific detection rules and indicators of compromise have not been publicly detailed.

It appeared on a single security blocklist, specifically PhishDestroy, and received trust scores of 1/100 from Scamadviser and 0/100 from Gridinsoft, further corroborating its malicious classification. The page title, 'Suspected phishing site | Cloudflare,' aligns with Cloudflare’s automated detection and mitigation response, which resulted in a 403 HTTP status at the time of this report. No evidence links this domain to a specific brand or phishing kit, and the exact content of the phishing page remains unanalyzed. The SSL certificate, issued by Google Trust Services (WE1), does not provide additional attribution beyond standard Cloudflare-managed encryption.

Defenders should treat this domain as confirmed malicious infrastructure, particularly for credential harvesting. Network-level blocking of the IP 188.114.97.3 and monitoring for related subdomains under *.pages.dev are recommended. Given the domain’s current offline status, further investigation may require historical DNS or web archive data to reconstruct the attack chain.