distributions-pepe[.]net

The domain distributions-pepe.net was registered on February 21, 2026 and is presently taken offline. DNS resolution points to the IP address 188.114.96.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. Network fingerprints show the site was served behind Cloudflare’s edge network and employed HTTP/3, indicating a modern web stack that can obscure the true origin of the server. The SSL certificate presented for the domain is identified as "WE1," confirming that TLS was in place at the time of observation.

Threat‑intelligence aggregators have flagged the domain: AlienVault OTX references it in a single pulse, and VirusTotal reports that 17 of 93 scanning engines flagged the host as malicious. Independent blocklists have listed the domain on four separate watchlists, and commercial filtering services PhishDestroy, MetaMask, ScamSniffer, and SEAL have all added it to their deny lists. These converging data points suggest the domain was used for a generic phishing campaign, though the exact lure or target brand has not been disclosed in the available evidence.

Because the site is currently offline, active payloads cannot be examined, and the specific content served (page title, credential‑harvesting forms, or redirection behavior) remains unknown. Defenders should continue to block the domain at perimeter and endpoint layers, monitor for any re‑hosting attempts on alternative IP ranges, and update threat‑intel feeds with the observed indicators. Ongoing vigilance is advised, especially given the recent creation date and the rapid adoption of Cloudflare’s HTTP/3 protocol, which can be leveraged to evade traditional detection mechanisms.