8b7500ce[.]ripsyr[.]pages[.]dev

The domain 8b7500ce.ripsyr.pages.dev was created on September 02, 2020 and registered through Cloudflare, Inc., using the authoritative nameservers adi.ns.cloudflare.com and karl.ns.cloudflare.com. DNS resolution points to IP address 172.66.47.147, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. HTTP probing returned a 403 status code and the page title reported by the server is "Suspected phishing site | Cloudflare." The site employed HSTS, HTTP/3, and a TLS certificate issued by Google Trust Services under the WE1 certificate authority, indicating use of modern security mechanisms despite the malicious intent.

A Gridinsoft trust score of 0 out of 100 reflects an extreme lack of credibility. The domain appears on one known security blocklist and has been explicitly blocked by the PhishDestroy service. VirusTotal analysis shows that 11 of 93 scanned security vendors flagged the domain, and Google Safe Browsing classifies it as a social engineering threat, reinforcing the credential phishing categorization.

As of the report date, the site is listed as offline, which may indicate takedown or temporary suspension. Defenders should continue to block the domain at network boundaries, monitor for any re‑hosting of the same indicator set, and incorporate the IP address 172.66.47.147 and associated Cloudflare nameservers into their threat intelligence feeds. Ongoing surveillance is recommended to detect potential resurrection of the infrastructure under new subdomains or alternative hosting arrangements.