navietkoreeark-iyqpghzkjpbbwislcvsskpft[.]pages[.]dev

The domain navietkoreeark-iyqpghzkjpbbwislcvsskpft.pages.dev was created on March 11, 2026 and is currently taken offline, returning an HTTP 403 status. Its DNS resolves to 188.114.97.3, an address owned by Cloudflare, Inc. (AS13335) and located in the United States. The site is served over TLS using a Let’s Encrypt certificate (issuer E8) and employs Cloudflare‑provided security features including HSTS and HTTP/3. The page title presented by the server reads "Suspected phishing site | Cloudflare," indicating that the host itself has flagged the content as malicious.

Infrastructure analysis shows the domain is registered through Cloudflare’s registrar and uses the Cloudflare nameservers jade.ns.cloudflare.com and lee.ns.cloudflare.com. Detection data indicate that 10 of 94 security vendors on VirusTotal have flagged the domain, and it appears on a single external blocklist. PhishDestroy has explicitly blocked the domain, and Gridinsoft assigns it a trust score of 0 out of 100, reflecting a high confidence of malicious intent. No additional intelligence such as brand targeting, malware kit, or detailed payload information is available from the supplied data.

Given the combination of a phishing‑related page title, multiple vendor detections, a zero trust score, and active blocklisting, defenders should treat the domain as a confirmed phishing infrastructure. Recommended actions include continuing to monitor the domain’s DNS and IP for any re‑activation, ensuring that web filtering and email security solutions block both the domain and its IP address, and sharing the indicator of compromise with threat‑sharing communities. Since the site is already offline, remediation efforts can focus on preventing future reuse of the same infrastructure and updating detection rules to cover similar Cloudflare‑hosted phishing patterns.