app-pepeheimer[.]pages[.]dev

The domain app-pepeheimer.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and is currently listed as offline. DNS resolution points to the Cloudflare edge IP 172.66.44.233, which belongs to AS13335 Cloudflare, Inc. in the United States. The authoritative nameservers are zac.ns.cloudflare.com and carla.ns.cloudflare.com, confirming that the domain is fully hosted on Cloudflare's infrastructure. The site presents the page title "Suspected phishing site | Cloudflare" and returns an HTTP 403 status code, indicating that access is being blocked at the web server level.

The SSL certificate is issued by Google Trust Services under the WE1 certificate authority, providing a valid TLS handshake but offering no indication of legitimacy. Reputation services assign extremely low scores: Scamadviser rates the domain 1 out of 100, and Gridinsoft assigns a score of 0 out of 100. The domain appears on one security blocklist and is explicitly blocked by the PhishDestroy service. VirusTotal analysis shows that 10 of 93 security vendors have flagged the domain, reinforcing the suspicion of malicious activity.

The overall threat classification is credential phishing, suggesting attempts to harvest login credentials. While the exact phishing lure or targeted brand is not disclosed in the observed metadata, the combination of low trust scores, blocklist presence, multiple vendor detections, and the Cloudflare‑hosted page titled as a suspected phishing site provides strong evidence of malicious intent. Defenders should continue to block the domain at perimeter filters, monitor for any related DNS queries to the associated Cloudflare IP, and consider adding the IP address to reputation‑based blocklists. Incident response teams should also check for any credential reuse that might have been attempted against internal accounts, and educate users to avoid interactions with URLs that resolve to this domain or its associated IP range.