3c33c32c[.]pages[.]dev

On 2026-08-07 the domain 3c33c32c.pages.dev was observed as an active high‑risk phishing infrastructure. The domain resolves to the IP address 172.66.44.250, which is part of the Cloudflare network and is commonly used for fastly‑served static sites, indicating the operator is leveraging a reputable CDN to conceal the true origin of the malicious payload. Two independent phishing blocklists, PhishDestroy and OpenPhish, have already listed the domain, confirming that it is being used to deliver fraudulent content.

Google Safe Browsing classifies the URL as a social‑engineering threat, and VirusTotal reports that 14 out of 91 security vendors have flagged the domain as malicious, reinforcing the confidence that the site is part of a phishing campaign. The presence on multiple blocklists and the multi‑vendor detection ratio of roughly 15 % suggest a coordinated operation that may be reused across other subdomains. The precise content hosted at the domain has not been publicly disclosed; no page title, SSL certificate details, or HTTP response codes have been released in the current intelligence set, leaving the exact credential‑stealing technique and targeted brand unknown.

Because the domain is served behind Cloudflare, traditional sink‑hole methods may be less effective, so DNS‑level filtering is recommended. Defenders should block any network traffic to 3c33c32c.pages.dev and add the IP address 172.66.44.250 to deny‑list rules. Continuous monitoring of the two blocklists and VirusTotal for additional detections is advised, as further analysis may reveal the underlying phishing kit or victim‑targeting patterns.