alnex-biz-santix-8126[.]pages[.]dev

The domain alnex-biz-santix-8126.pages.dev has been identified as a credential theft phishing threat, designed to trick visitors into revealing sensitive information by impersonating a legitimate service. This domain was registered through Cloudflare, Inc. on April 07, 2026, and resolves to IP address 172.66.44.177. It appears on one security blocklist, and VirusTotal reports that 11 out of 95 security vendors flag this domain as malicious. The page title observed was 'Suspected phishing site | Cloudflare,' indicating that Cloudflare's own systems recognized the threat and issued a warning.

Technically, the domain uses an SSL certificate from Google Trust Services (WE1), which is commonly abused by phishing sites to appear legitimate. The domain is hosted on Cloudflare Pages infrastructure, making it easy to deploy but also allowing rapid takedowns. Google Safe Browsing has likely flagged this site, though the exact status was not provided; however, the presence on blocklists and the Cloudflare warning suggest it was actively blocked. The IP address 172.66.44.177 is associated with Cloudflare's CDN, and the domain was created just days before analysis, a common pattern for phishing operations.

Currently, alnex-biz-santix-8126.pages.dev is offline and has been taken down, likely due to reports to Cloudflare or the registrar. Despite being offline, the domain could be reactivated or similar domains may appear. Users who may have visited this site should change passwords for any accounts entered and monitor for suspicious activity. It is crucial to avoid visiting this domain or any similar variations, and to report any new discoveries to security teams. PhishDestroy recommends using multi-factor authentication and staying vigilant against unsolicited login pages.