pepecoln[.]net

Analysis of pepecoln.net indicates a high-risk phishing domain registered on September 9, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com. The domain resolves to IP address 104.21.75.136 and is protected by Cloudflare infrastructure, including Cloudflare Browser Insights and HTTP/3 support, which may hinder takedown efforts and analysis. The page title 'Just a moment...' is consistent with Cloudflare interstitial pages, often exploited to delay or obscure malicious content from automated scanners. As of July 12, 2026, the domain remains active and is flagged on two security blocklists, including PhishDestroy and BLP-Malware. It has also been referenced in 23 threat intelligence pulses on AlienVault OTX, suggesting broader detection within the security community. Four of 95 security vendors on VirusTotal have flagged the domain, though the specific nature of the phishing content has not been fully analysed. The SSL certificate is issued by Google Trust Services, which may lend an appearance of legitimacy to potential victims. Defenders should treat this domain as actively malicious. Blocking the domain and its resolving IP at the network level is recommended. Given the use of Cloudflare, monitoring for changes in resolving IPs or additional domains associated with the same infrastructure may help identify related threats. Further investigation into the phishing kit or targeted brand is warranted, though no specific brand or scam type has been confirmed at this time.