p2-stable[.]app

This domain, p2-stable.app, is currently flagged as an active phishing threat targeting financial or transactional workflows. Analysis indicates it is hosted behind Cloudflare infrastructure, resolving to the IPv4 address 104.21.80.90, and presents a generic 'Just a moment...' page title commonly associated with intermediate redirect or filtering mechanisms. The domain appears on two security blocklists and is detected by 5 out of 95 security vendors on VirusTotal, while AlienVault OTX records its presence in 23 threat intelligence pulses, suggesting repeated abuse over time. Infrastructure analysis reveals the use of Cloudflare services, including Browser Insights and HTTP/3, alongside a SSL certificate issued by Google Trust Services. These elements are consistent with modern phishing campaigns that leverage legitimate CDN and hosting providers to evade detection and maintain operational resilience. The page title alone does not confirm the exact nature of the phishing attempt, but the combination of blocklist entries, vendor detections, and threat intelligence pulses strongly indicates malicious intent. Defenders should treat this domain as high-risk and implement immediate blocking measures. The observed indicators—such as the Cloudflare-hosted infrastructure, the absence of legitimate content, and the domain's presence on multiple threat feeds—justify proactive mitigation. While the specific brand or service being impersonated remains unconfirmed, the domain's behavior aligns with payment redirection or credential harvesting schemes. Network security teams are advised to monitor for connections to 104.21.80.90 and correlate logs with known phishing patterns associated with this domain.