distribution-ponke[.]xyz

On 23 July 2026, the domain distribution-ponke.xyz was observed hosting a generic phishing site titled “PONKE – We’re all PONKE”. The site was taken offline shortly after detection and is currently listed as offline. The domain was registered on 21 February 2026 and resolves to the IP address 104.21.96.1, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The TLS certificate presented is the Cloudflare TLS Issuing ECC CA 1 chain, indicating the use of Cloudflare’s CDN and SSL termination services.

The domain appears on a single security blocklist and has been blocked by the PhishDestroy service. VirusTotal analysis shows that five out of ninety‑three scanned scanners flagged the domain, confirming the presence of malicious indicators. No additional intelligence such as the underlying phishing kit, targeted brand, or payload delivery method has been released, leaving the exact attack vector and victim profile unconfirmed.

Defenders should continue to monitor the IP address 104.21.96.1 for any re‑use, update intrusion‑prevention and web‑filter policies to block the domain and its associated IP, and consider adding the domain to internal blocklists. Given the Cloudflare front‑end, further analysis of traffic patterns may be required to determine if the infrastructure is being repurposed for other campaigns. Organizations should remain vigilant for any emails or communications referencing “PONKE” that could be tied to this infrastructure, and should apply standard phishing mitigation controls such as MFA, user education, and URL reputation checks.