pickashow[.]com[.]pk

The domain pickashow.com.pk was registered on September 20, 2025 and is currently active. DNS resolution points to 188.114.97.3, an IP owned by Cloudflare (AS13335) located in the United States. The authoritative nameservers are bailey.ns.cloudflare.com and charles.ns.cloudflare.com, and the domain is protected by a Google Trust Services / WE1 SSL certificate, indicating a valid TLS handshake. HTTP requests return status code 200 and the page title observed is "Pikashow APK Download (Updated) Latest Version For Android," suggesting the site is presenting a malicious Android application download. Infrastructure analysis shows the use of Cloudflare services and HTTP/3, which can obscure the true origin of the traffic. Reputation data is poor: Gridinsoft assigns a trust score of 0 / 100, and two of ninety‑one VirusTotal scanners flag the domain. The domain is listed on three security blocklists and has been blocked by PhishDestroy, MetaMask, and SEAL, confirming its classification as a generic phishing threat. MX records are present (priority 11 to route1.mx.cloudflare.net and priority 89 to an undisclosed host), but no email activity has been reported. While the page content has not been fully examined, the combination of a recent creation date, low trust score, blocklist presence, and the malicious‑sounding APK download title indicates a high‑risk phishing operation. Defenders should block the domain at the DNS and proxy layers, monitor for connections to the associated Cloudflare IP, and consider adding the domain to internal blocklists. Continuous re‑evaluation is recommended, as the threat actor may modify the payload or hosting infrastructure without notice.