xmagnetic-extension[.]pages[.]dev

On July 29, 2026 analysts observed that the sub‑domain xmagnetic-extension.pages.dev resolves to the IPv4 address 188.114.97.3. The domain is hosted on Cloudflare, Inc., as indicated by the authoritative name servers annalise.ns.cloudflare.com and rohin.ns.cloudflare.com. No registrar‑level details beyond the Cloudflare registration are available, and the domain does not expose any public SSL certificate metadata in the current data set. VirusTotal has recorded three positive detections out of ninety‑one submitted scanners, confirming that multiple security engines have flagged the address as malicious. The domain is presently listed on a single external blocklist and is actively blocked by the PhishDestroy feed, reinforcing its classification as a phishing‑related resource.

The evidence points to a generic phishing infrastructure that leverages Cloudflare’s fast‑deployment capabilities to host malicious content. However, the absence of a captured page title, brand target, or detailed HTTP response prevents analysts from confirming the exact victim brand or the specific credential‑harvesting technique employed. Consequently, the precise phishing vector (e.g., login clone, credential‑stealing form, or malicious redirect) remains undetermined.

Defenders should immediately add xmagnetic-extension.pages.dev to DNS‑based blocklists and ensure that endpoint protection solutions reference the current VirusTotal detections. Network monitoring for outbound connections to 188.114.97.3 is advisable, as is the inspection of any TLS‑encrypted traffic to Cloudflare‑served domains that may be used as a proxy for the malicious payload. Continuous re‑evaluation of the domain is recommended, given the limited visibility into its content and the potential for rapid repurposing typical of generic phishing campaigns.