shibarmypr[.]pages[.]dev

Analysis of shibarmypr.pages.dev shows a high‑risk credential‑phishing infrastructure that was taken offline as of the report date, 24 July 2026. The domain was registered through Cloudflare, Inc. on 21 February 2026 and resolves to the Cloudflare‑owned address 188.114.97.3, belonging to AS13335 in the United States. DNS resolution uses the authoritative Cloudflare nameservers koa.ns.cloudflare.com and shubhi.ns.cloudflare.com, confirming that the attacker leveraged Cloudflare’s edge services for hosting. The site presented the page title “Suspected phishing site | Cloudflare” and served an HTTP 403 response, indicating that the content was blocked by Cloudflare’s security controls. TLS termination employed a Google Trust Services certificate issued to “WE1”, which is a standard Cloudflare‑provided certificate chain and does not reveal any custom malicious payloads.

Threat intelligence feeds have listed the domain on three blocklists—PhishDestroy, ScamSniffer, and Enkrypt—each classifying it as a credential‑phishing site. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious nature of the host. VirusTotal analysis recorded 12 detections out of 93 security vendors, providing independent confirmation of malicious activity. Detected technologies include HTTP/3, HSTS, and Cloudflare’s CDN, all of which are typical for phishing sites seeking to improve reliability and evade simple network‑level filters. While the page content has not been publicly captured, the combination of a recent registration date, Cloudflare‑based hosting, a generic phishing page title, blocklist presence, low trust score, and multiple vendor detections collectively indicate a purpose‑built credential‑phishing operation.

Uncertainty remains regarding the specific target brand or credential set being harvested, as no brand name appears in the page title or other supplied metadata.