r982820[.]pages[.]dev

The domain r982820.pages.dev is currently active and has been identified as a brand‑impersonation site targeting Apple. The page title returned by the server is “Apple”, and the site is listed on a single security blocklist, PhishDestroy, which has flagged it as malicious. The registration date of March 30 2026 and the use of Cloudflare‑provided nameservers (josephine.ns.cloudflare.com, malcolm.ns.cloudflare.com) indicate a newly created infrastructure. Network analysis shows the domain resolves to IP 172.66.47.100, an address owned by Cloudflare, Inc. and geolocated to Canada. The HTTPS certificate is issued by Google Trust Services under the WE1 label, and the site presents HTTP 301 redirects. Detected client‑side technologies include Apple MapKit JS, HSTS enforcement, and Akamai delivery services, suggesting the page is crafted to resemble legitimate Apple content while leveraging third‑party performance optimizations. Reputation scoring from Gridinsoft assigns a trust score of 0 / 100, reflecting a high likelihood of abuse. VirusTotal currently reports zero detections across 95 engines, but the lack of detections is not evidence of safety given the recent creation date and the low trust score. The sole blocklist entry and the presence of brand‑specific assets indicate a focused impersonation campaign rather than a broad‑based spam operation. Defenders should add r982820.pages.dev to local deny lists and configure network controls to block traffic to the associated IP address. Continuous monitoring of DNS changes and certificate updates is advised, as the attacker could pivot to new IPs or certificates while retaining the same domain. Incident response teams should also monitor for similar pages that use Apple MapKit JS and HSTS in conjunction with Akamai, as these components may serve as a pattern for future impersonation attempts.