pudgypenguins-vb[.]pages[.]dev

Analysis of pudgypenguins-vb.pages.dev shows a newly registered domain (created 21 Feb 2026) that resolves to Cloudflare edge IP 104.21.32.1, belonging to ASN 13335 in the United States. The domain is delegated to Cloudflare nameservers arya.ns.cloudflare.com and will.ns.cloudflare.com, indicating the infrastructure is fully hosted behind Cloudflare’s CDN and WAF. An HTTP 403 response is returned for the root request, and the page title presented by Cloudflare reads “Suspected phishing site | Cloudflare,” which is a default warning page used when Cloudflare has flagged the host as malicious. The site appears on three independent security blocklists and has been explicitly blocked by PhishDestroy, MetaMask, and SEAL, reinforcing the classification as a phishing vector.

Reputation scoring from Gridinsoft assigns a trust score of 0 / 100, reflecting a lack of trust. The TLS certificate is issued by Google Trust Services under the WE1 root, confirming a valid HTTPS configuration but offering no indication of legitimacy. VirusTotal reports that 93 scanning engines have examined the domain, and no detections were recorded, though this absence does not constitute evidence of safety. The combination of a recent registration, Cloudflare‑hosted IP, default phishing warning page, inclusion on multiple blocklists, and a zero trust score provides concrete indicators that the domain is being used for phishing or related abuse.

However, the offline status prevents direct observation of malicious content, and no specific payload or credential‑stealing page has been captured. Defenders should continue to block the domain at network perimeter and endpoint filters, monitor for any re‑activation, and consider adding the IP address 104.21.32.1 to threat‑intel feeds. Ongoing verification of the blocklist entries and periodic re‑scanning with sandbox tools are recommended to capture any future changes in behavior.