chymnrmp[.]pages[.]dev

On July 24, 2026 the domain chymnrmp.pages.dev was identified as a high‑risk brand‑impersonation infrastructure targeting Apple users. The site presented the page title “iCloud”, indicating an attempted impersonation of Apple’s iCloud service. Technical inspection shows the domain is hosted behind Cloudflare’s network (AS13335) and resolves to the IP address 23.215.23.51 located in the United States. DNS resolution uses the Cloudflare authoritative nameservers duke.ns.cloudflare.com and teresa.ns.cloudflare.com. The HTTPS endpoint is secured by a certificate issued by Google Trust Services under the WE1 root, confirming the use of a legitimate TLS chain but not legitimising the underlying content.

HTTP requests receive a 403 status code, suggesting the site was already taken offline at the time of analysis. Reputation signals are strongly negative. Gridinsoft assigns a trust score of 0 out of 100, and Google Safe Browsing classifies the URL as a social‑engineering threat. VirusTotal reports that 13 of 91 scanning engines flagged the domain, reflecting a broad consensus of malicious intent. The domain is listed on at least one public blocklist and has been explicitly blocked by the PhishDestroy mitigation service.

No additional public intelligence such as malware‑dropping payloads or credential‑harvesting scripts has been disclosed, so the exact phishing kit employed remains unknown. Defenders should continue to block chymnrmp.pages.dev at network perimeter and DNS filters, and monitor for any re‑appearance of the host or associated IP address. Because the infrastructure relies on a shared Cloudflare front end, threat actors could rapidly redeploy a similar site using the same domain suffix, so rule sets that capture the full subdomain pattern (*.pages.dev) are recommended. Ongoing vigilance of Google Safe Browsing updates and VirusTotal re‑scans will help capture any future changes in the domain’s status.