i-pag[.]org

Analysis on i-pag.org indicates the domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is currently resolved to 104.21.63.74, an address belonging to Cloudflare, Inc. (AS13335) located in the United States. The authoritative nameservers are coco.bunny.net and kiki.bunny.net, both appearing to be custom‑owned. The site served a Let's Encrypt certificate signed with the E8 identifier, confirming the use of a free TLS certificate. A Gridinsoft trust score of 0 / 100 reflects an extremely low reputation. Content inspection reveals the page title “Individual Pacific Alliance Group | iPag”, but no further page content has been captured because the site is offline at the time of analysis.

The infrastructure stack includes Vue.js, jsDelivr, jQuery, cdnjs and Cloudflare services with HTTP/3 enabled, suggesting a modern web framework. VirusTotal reports that three of ninety‑three scanning engines flagged the domain, and the domain appears on one external blocklist. PhishDestroy has already added i-pag.org to its blocklist, and the overall risk level is elevated. The domain is classified as a brand‑impersonation campaign targeting the brand “across”, although the exact nature of the impersonation cannot be confirmed without live page content.

Defenders should continue to block the domain at perimeter and DNS filters, monitor for any resurgence of activity from the same IP or nameserver pair, and consider adding the domain to internal threat intelligence feeds. Because the site uses Cloudflare’s network, future malicious payloads could be hosted behind the same IP address, so correlation with other Cloudflare‑hosted indicators is advisable. Ongoing observation of the registrar NiceNIC and the custom nameservers may reveal additional malicious domains that share this infrastructure.