32e3x2x[.]pages[.]dev

Analysis of the domain 32e3x2x.pages.dev, conducted on August 06, 2026, indicates active credential phishing infrastructure. The domain resolves to IP address 172.66.47.3, which is associated with Cloudflare's content delivery network. As of the latest available data, 9 out of 91 security vendors on VirusTotal have flagged this domain as malicious, though the specific detection rules or signatures triggering these alerts are not disclosed in the available intelligence. The domain appears on one security blocklist, and Google Safe Browsing has classified it under 'social engineering,' a category that encompasses deceptive practices designed to trick users into divulging sensitive information such as login credentials or financial details.

No registrar or hosting provider details beyond the IP resolution are currently available, and the exact content or targeted brand of the phishing page remains unconfirmed. The domain is hosted on Cloudflare Pages (pages.dev), a platform that allows for rapid deployment of static sites, which is frequently exploited for short-lived phishing campaigns due to its ease of use and free tier. The use of Cloudflare's infrastructure also complicates takedown efforts, as the hosting provider may not immediately identify or act on abuse reports without clear evidence of malicious activity. Defenders are advised to block the domain 32e3x2x.pages.dev and its resolving IP 172.66.47.3 at the network perimeter.

Security teams should monitor for connections to this domain in proxy logs, endpoint detection and response (EDR) telemetry, and DNS query data. If internal users have accessed this domain, credentials entered on the site should be considered compromised and reset immediately. Given the domain's presence on a single blocklist and limited vendor detections, additional scrutiny of related infrastructure (e.g., subdomains, co-hosted IPs) is recommended to identify potential lateral movement or secondary payload delivery.