heartcore-rp[.]de

heartcore-rp.de was observed on July 12 2026 delivering a brand impersonation campaign targeting Discord users. The site presents the page title 'Heart-C.O.R.E' and is classified under the social_media scam type. The domain is hosted behind Cloudflare's network and resolves to IP 104.26.5.47. Infrastructure analysis shows the IP belongs to AS13335, a Cloudflare hosting network based in the United States. DNS resolution is handled by ian.ns.cloudflare.com and roxy.ns.cloudflare.com, confirming the use of Cloudflare’s DNS service. The web server reports HTTP 200 and serves content built with Vue.js, with the front‑end delivered over a TLS certificate issued by Google Trust Services under the WE1 root. Reputation services flag the domain as highly malicious. The Gridinsoft trust score is 0 out of 100, and the domain appears on at least one security blocklist. VirusTotal scans return two positive detections out of ninety‑five engines, indicating that some scanners have identified malicious behavior. PhishDestroy has already blocked the domain, and current monitoring shows the site remains active. Defenders should add heartcore-rp.de to inbound and outbound deny lists across email, web proxy, and DNS filtering solutions. Security teams should monitor for connections to 104.26.5.47 and for any use of the ian.ns.cloudflare.com or roxy.ns.cloudflare.com name servers that may indicate related infrastructure. Continuous threat‑intel feeds should be consulted for additional indicators as the campaign evolves.