pippin-loves[.]fun

This domain, pippin-loves.fun, is currently under investigation for hosting a phishing site designed to impersonate legitimate brand login portals. Analysis indicates the threat type involves credential harvesting through fake authentication interfaces, likely targeting users of a specific service or platform. The domain remains active and has not yet been widely detected by security vendors. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 188.114.96.3 and is protected by Cloudflare, utilizing HTTP/3 for content delivery. It was registered on February 21, 2026, through NiceNIC International Group Co., Limited. The SSL certificate is issued by Google Trust Services, a common feature in both legitimate and malicious sites. As of the latest scan, the domain has been flagged by 0 of 95 vendors on VirusTotal, though it appears on one security blocklist and is actively blocked by a specialized phishing detection system. The page title, 'Just a moment...,' is consistent with Cloudflare interstitial pages, which may be used to obscure malicious content from automated scanners. Current findings suggest the domain poses a credible threat to users who may be deceived into entering sensitive credentials. While detection rates remain low, the presence on a security blocklist and the use of Cloudflare infrastructure warrant caution. Organizations and individuals are advised to block the domain at the network level and monitor for related indicators, including the IP address 188.114.96.3. Users should verify the authenticity of login portals before entering credentials and report suspicious domains to relevant security teams for further analysis.