peacefrog[.]world

Analysis of peacefrog.world shows a newly created domain (April 21, 2026) that is actively serving a generic phishing payload. The site presents an HTTP 403 status, indicating that the malicious content is likely delivered only to targeted requests or after a specific interaction. The domain is secured with a Let’s Encrypt certificate (E7), and all DNS resolution points to the Cloudflare edge IP 188.114.97.3, which is registered to Cloudflare, Inc. in Canada. Nameserver delegation to june.ns.cloudflare.com and nikon.ns.cloudflare.com confirms the use of Cloudflare’s infrastructure, including HTTP/3 support, a common tactic to obscure traffic patterns.

Threat intelligence correlates the domain with 22 AlienVault OTX pulses and a single external blocklist entry. PhishDestroy has already blocked the domain, and VirusTotal reports that 7 of 95 scanned security vendors flag the site as malicious, reinforcing the suspicion of phishing activity. The registrar listed is NICENIC INTERNATIONAL GROUP CO., LIMITED, a known provider for rapidly provisioned domains used in abuse campaigns.

Uncertainty remains around the specific brand or credential harvesting scheme employed, as no explicit impersonated entity is observable from the available data. The lack of a visible landing page behind the 403 response limits immediate content analysis, and the domain’s short lifespan suggests a fast‑flux approach designed to evade detection while delivering targeted lures.

Defenders should add peacefrog.world to internal blocklists and enforce outbound DNS filtering to prevent resolution to the Cloudflare IP 188.114.97.3. Monitoring for requests to the domain, especially over HTTP/3, will aid in identifying compromised endpoints. Given the existing blocklist presence and the 22 OTX references, organizations should also review user reports for similar phishing attempts and educate users on avoiding unsolicited credential requests that may originate from this infrastructure.