goyim-event-fun-2ca3f6[.]pages[.]dev

The domain goyim-event-fun-2ca3f6.pages.dev is confirmed as an active credential theft operation. Analysis indicates this site is designed to harvest login credentials, likely through fake login portals or deceptive forms. The page title 'Goyim collaboration' suggests an attempt to mimic legitimate collaboration platforms, though no specific brand impersonation has been identified. The domain remains operational as of the latest verification. Infrastructure analysis reveals the domain resolves to IP address 188.114.96.3 and was registered through Cloudflare Pages on February 05, 2026. Security vendors have flagged this domain, with 3 of 95 VirusTotal engines detecting malicious activity. The site appears on one security blocklist and uses an SSL certificate issued by Google Trust Services (WE1). The creation date indicates recent deployment, aligning with typical phishing campaign timelines. Current status shows the domain is still active and delivering malicious content. Organizations should implement immediate blocking of the domain and associated IP address 188.114.96.3. Endpoint protection systems should be updated to detect and prevent access to this resource. Users who may have interacted with this domain should reset credentials for any accounts accessed during the exposure window. Network monitoring should watch for connections to 188.114.96.3 or related subdomains under the pages.dev infrastructure. Security teams should treat this as a high-risk incident requiring immediate containment measures.