0x38[.]team

The domain 0x38.team was registered on August 12, 2025 through NameCheap, Inc. and is currently classified as a high‑risk, active generic phishing campaign. The site returns HTTP 200 and presents a page titled “CRM V3,” a common lure for credential‑stealing operations targeting customer‑relationship‑management platforms. The threat has been observed by multiple security blocks, and PhishDestroy currently lists the domain as blocked.

Infrastructure analysis shows that 0x38.team resolves to the IP address 188.114.97.3, which belongs to AS13335 operated by Cloudflare, Inc., located in the United States. The domain uses Cloudflare’s authoritative nameservers mario.ns.cloudflare.com and may.ns.cloudflare.com, and the TLS certificate is issued by Google Trust Services under the WE1 trust chain. Independent scoring from Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on one public blocklist.

Detection data indicates that three of ninety‑five security vendors on VirusTotal have flagged the domain, confirming that at least a subset of scanners recognize malicious behavior. The site’s response code of 200 suggests that the phishing page is actively serving content, and the “CRM V3” title aligns with the generic phishing classification. However, the available intelligence does not reveal the specific phishing kit, payload, or any compromised accounts, leaving the exact attack vector and victim profile uncertain.

Defenders should prioritize immediate remediation by adding 0x38.team to URL filtering and DNS blocklists, and by monitoring outbound traffic for connections to the associated Cloudflare IP. Continuous probing of the domain’s certificate and DNS records is advised to detect any future changes. Organizations that rely on CRM systems should reinforce credential hygiene, enforce multi‑factor authentication, and educate users about unsolicited login prompts that reference “CRM V3” or similar terminology.