author-3lx[.]pages[.]dev

This domain, author-3lx.pages.dev, is currently under investigation for hosting generic phishing infrastructure. Registered on September 2, 2020, through Cloudflare Pages, the domain resolves to the IP address 172.66.47.54. As of July 29, 2026, it appears on one security blocklist and is actively blocked by PhishDestroy. Analysis via VirusTotal indicates that 14 out of 91 security vendors have flagged this domain as malicious, reinforcing its elevated risk classification.

Infrastructure analysis reveals the domain is hosted on Cloudflare’s network, a common choice for both legitimate and malicious actors due to its ease of deployment and built-in protections. The specific content or target of the phishing operation remains unconfirmed, as no brand, scam type, or page title details were provided in available intelligence. Defenders should treat this domain as active and potentially harmful, particularly given its presence on blocklists and detection by multiple security vendors.

Organizations are advised to update their web filtering rules to block access to author-3lx.pages.dev and monitor network traffic for connections to 172.66.47.54. While the domain’s longevity (registered in 2020) may suggest persistent use, no additional historical context or campaign linkages are currently available. Further investigation into associated URLs, SSL certificates, or redirect chains may provide additional clarity on its operational scope.