0x-alphafi[.]pages[.]dev

The domain 0x-alphafi.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and is serviced by Cloudflare’s infrastructure (nameservers marjory.ns.cloudflare.com and burt.ns.cloudflare.com). DNS resolution points to IP address 188.114.97.3, which is announced by AS13335 Cloudflare, Inc. and geolocated to the United States. The site presented a page title of "Suspected phishing site | Cloudflare" and returned an HTTP 403 status code, indicating that the resource is currently inaccessible. Transport security is enforced with HSTS and the site supports HTTP/3, while the TLS certificate is issued by Google Trust Services under the WE1 trust profile.

Reputation monitoring shows a Gridinsoft trust score of 0 out of 100, reflecting a very low credibility rating. The domain appears on a single public blocklist, PhishDestroy, and Google Safe Browsing has flagged it for social engineering. VirusTotal analysis recorded 10 detections out of 93 scanned security vendors, confirming malicious activity. The overall risk assessment is classified as high, and the campaign is identified as credential phishing.

The domain is currently offline, limiting immediate interaction, but its recent creation date and use of reputable hosting services suggest a deliberate attempt to exploit trust in Cloudflare‑provided certificates. Defenders should add the IP address 188.114.97.3 and the domain 0x-alphafi.pages.dev to block lists, monitor for any resurgence, and correlate any authentication attempts to corporate services with this indicator. Continuous threat‑intel feeds should be consulted for potential re‑use of the same infrastructure in future campaigns.