agent-2mx[.]pages[.]dev

PhishDestroy identifies agent-2mx.pages.dev as a LIVE credential-theft page posing as a Microsoft support portal. Current risk level is UNDER INVESTIGATION yet active, indicating rapid deployment. The domain leverages Cloudflare Pages and Let’s Encrypt to appear legitimate while exfiltrating Office 365 credentials through a convincing phishing form. Users must treat every login prompt from this host as a hostile takeover attempt and terminate sessions at once.

This domain was flagged via seed 54de92 and is currently resolving to IP 188.114.97.3 under Cloudflare, Inc. registration. VirusTotal shows 6/95 detections at present, meaning no antivirus engines have added detections yet, but behavior analysis confirms an active Microsoft 365 credential phishing flow. SSL certificate issued by Let’s Encrypt provides a false veneer of trust, typical of modern phishing infrastructures. The pages.dev subdomain indicates use of Cloudflare Pages for fast, disposable landing zones ideal for short-lived campaigns. No IP or domain blocklists have yet flagged this indicator, leaving a narrow detection window for end users.

Mitigation must focus on real-time user interception and credential lockdown. Block agent-2mx.pages.dev at the DNS or firewall layer using reputation feeds. Enable MFA on all Microsoft 365 accounts and require conditional-access policies to block logins from unknown geographies. Instruct users to verify any unexpected login prompts by checking the exact URL and looking for HTTPS, but do NOT trust it alone—confirm via a known-good support channel. Report the IP 188.114.97.3 and domain to Microsoft Security Intelligence and to Cloudflare Abuse for takedown under seed 54de92. Conduct a password audit and force password resets for any accounts suspected of interaction.