epicclash[.]pro

Analysis of epicclash.pro, observed on July 23, 2026, shows the domain is currently offline but retains a set of indicators that warrant elevated risk classification. The site was registered through Cloudflare, Inc., and uses Cloudflare's DNS infrastructure (dion.ns.cloudflare.com and eloise.ns.cloudflare.com). No SSL certificate was presented, meaning all HTTP traffic would have been unencrypted. The domain resolves to IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States.

The page title returned by the HTTP endpoint was "Nur einen Moment…", providing no further context about the content or intended victim demographic. Reputation services reflect extreme distrust: Gridinsoft assigned a score of 0 out of 100, while Scamadviser rated the domain at 1 out of 100. VirusTotal scans recorded 12 detections out of 95 security vendors, indicating that a notable subset of scanners identified malicious behavior. The domain appears on a single security blocklist and has been explicitly blocked by PhishDestroy, confirming that at least one anti‑phishing service has taken protective action.

AlienVault OTX references the domain in fifteen threat‑intel pulses, underscoring its recurrence in community‑driven feeds. Given the combination of low trust scores, multiple vendor detections, blocklist presence, and the lack of HTTPS, defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑hosting attempts, and update detection signatures to include the observed IP and nameserver pair. Because the site is offline, direct content analysis is unavailable; therefore, the exact phishing payload or targeted brand remains uncertain. Ongoing observation of the IP address and any future DNS changes is recommended to catch potential re‑deployment of the malicious infrastructure.