dashboard-littlepepe[.]pages[.]dev

On 29 July 2026, the domain dashboard-littlepepe.pages.dev was observed hosting a generic phishing campaign. The domain is registered via Cloudflare, Inc., using the Cloudflare‑owned nameservers savanna.ns.cloudflare.com and todd.ns.cloudflare.com, and resolves to the IP address 188.114.96.3, which belongs to the Cloudflare network. The shared nature of Cloudflare hosting limits direct attribution of the underlying operator, but the presence of Cloudflare‑managed DNS and IP infrastructure is a consistent indicator of the deployment model used by many malicious actors to obscure provenance. Reputation checks show that the domain appears on one public security blocklist and is actively blocked by the PhishDestroy service.

VirusTotal analysis reports that seven of ninety‑one scanning engines have flagged the domain as malicious, reinforcing the suspicion raised by other sources. No additional public intelligence such as Google Safe Browsing, OTX, or brand‑specific page titles has been released for this domain at the time of writing. The current evidence confirms that the domain is actively being used for phishing, but the specific lures, targeted brands, or credential‑capture mechanisms remain unknown because the landing page has not been publicly dissected. Consequently, defenders cannot determine the exact victim profile or the credential‑harvesting method employed.

Monitoring of DNS resolution to 188.114.96.3 and continued observation of blocklist status are recommended. Organizations should add dashboard‑littlepepe.pages.dev to internal block and alert lists, enforce strict URL filtering, and consider employing outbound DNS sinkholing to mitigate potential connections. Threat hunters should also track any future changes to the domain’s hosting configuration, DNS records, or detection scores, as shifts may indicate redeployment of the phishing infrastructure.