takepart2x[.]com

Analysis of takepart2x.com shows multiple indicators of malicious activity consistent with a social media phishing campaign. The domain was registered on February 21, 2026 through Dominet (HK) Limited and is served via Cloudflare’s network (laura.ns.cloudflare.com, milan.ns.cloudflare.com). DNS resolution points to IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site employed Cloudflare’s HTTP/3 protocol and presented a TLS certificate issued by Google Trust Services under the WE1 label, confirming the use of a legitimate certificate chain despite the underlying malicious intent.

HTTP probing returned a 403 status code while the page title reported "404 Not Found," indicating that the content is currently inaccessible, likely because the site has been taken offline. Google Safe Browsing has flagged the domain for social engineering, and VirusTotal records show that 12 of 93 security vendors identified the domain as malicious. The Gridinsoft trust score of 1 out of 100 further reflects a high likelihood of abuse. The domain appears on at least one security blocklist and has been specifically blocked by PhishDestroy.

While the offline state prevents direct observation of the phishing payload, the combination of recent registration, Cloudflare‑based hosting, low trust score, and multiple vendor detections provides strong evidence that takepart2x.com was used for social media phishing. Defenders should continue to block the domain at network perimeters, monitor for any re‑activation, and consider adding the IP address 188.114.97.3 to threat intelligence feeds. Ongoing vigilance is recommended, as the underlying infrastructure (Cloudflare) could be reused for future campaigns.