pennywhale-dapp-frontend-nuxt[.]pages[.]dev

Analysis of pennywhale-dapp-frontend-nuxt.pages.dev shows a newly‑registered domain (creation date 21 Feb 2026) that has been taken offline but exhibits multiple indicators of a phishing‑related infrastructure. The domain resolves to IP 188.114.97.3, which belongs to AS13335 (Cloudflare, Inc.) located in the United States. Hosting is provided through Cloudflare, as reflected by the authoritative nameservers miles.ns.cloudflare.com and nina.ns.cloudflare.com, and the presence of HSTS and HTTP/3 in the technology fingerprint. The TLS certificate is issued by Google Trust Services under the WE1 hierarchy, a typical Cloudflare‑managed certificate, confirming the use of Cloudflare’s edge‑SSL service.

The HTTP response code is 403, and the page title returned is “Suspected phishing site | Cloudflare”, indicating that Cloudflare itself is serving a block page rather than the original content. A Gridinsoft trust score of 0 / 100 further signals extreme distrust. The domain has been actively listed on at least one security blocklist and is currently blocked by PhishDestroy. VirusTotal scans report that one of ninety‑three security vendors has flagged the domain, reinforcing the suspicion of malicious intent. The documented scam type is “Investment Scam”, which aligns with typical phishing campaigns that lure victims with fraudulent investment offers.

Defenders should treat the domain as hostile. Immediate actions include adding pennywhale-dapp-frontend-nuxt.pages.dev to corporate deny‑lists, blocking outbound connections to the associated IP address (188.114.97.3), and ensuring that web filtering solutions reference the blocklist entries from PhishDestroy and the VirusTotal detection. Continuous monitoring for any re‑activation of the domain or changes in its DNS resolution is advised, as threat actors may attempt to resurrect the site using the same infrastructure.