join-naviprotocol[.]pages[.]dev

Analysis of join-naviprotocol.pages.dev indicates that the domain was registered on February 7, 2024 through Cloudflare, Inc. and is hosted on Cloudflare's network (AS13335) with the IP address 172.66.47.50 located in the United States. The authoritative nameservers are irena.ns.cloudflare.com and oswald.ns.cloudflare.com. When accessed, the site returned HTTP 403, and the page title presented by the server is "Suspected phishing site | Cloudflare," suggesting that the content has been flagged by Cloudflare's protective services. VirusTotal scanned the domain and recorded a single detection among 94 security vendors, confirming that at least one vendor identified malicious behavior.

Independent blocklist services—including PhishDestroy, MetaMask, ScamSniffer, and SEAL—have listed the domain, and it appears on four additional security blocklists, reinforcing the consensus that the site is malicious. Gridinsoft assigned a trust score of 0 out of 100, indicating a complete lack of reputation. The current operational status is offline, which may be the result of takedown actions or automated blocking.

Defenders should continue to block the domain at perimeter and endpoint layers, monitor DNS queries for the domain and its associated IP range, and update intrusion detection signatures to include the observed nameserver pattern. Given the Cloudflare hosting, any future re‑registration on the same IP space should be scrutinized. Threat intelligence feeds should be updated to reflect the domain's presence on multiple blocklists and its low trust score, and analysts should watch for new domains created through Cloudflare that exhibit similar HTTP 403 responses and page titles.