pippin-token[.]org

This domain, pippin-token.org, is actively flagged as a high-risk brand-impersonation phishing site. Registered on April 21, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain currently resolves to IP address 172.67.138.73, hosted on infrastructure associated with Cloudflare in Canada. Analysis of its nameservers (jill.ns.cloudflare.com, noel.ns.cloudflare.com) confirms reliance on Cloudflare’s content delivery network, a common tactic to obscure hosting origins and evade takedowns. The domain appears on three security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, indicating targeted detection by both general and cryptocurrency-focused security tools. A Gridinsoft trust score of 0/100 further corroborates its malicious classification. The scam type is explicitly categorized as brand impersonation, though the specific brand or service being mimicked is not detailed in available intelligence. The domain’s HTTP response returns a 403 status with the page title 'Just a moment...', a behavior consistent with Cloudflare’s interstitial challenge pages, which may indicate either an active phishing kit behind a protective proxy or a recently deactivated page awaiting reactivation. The SSL certificate, issued by Let’s Encrypt (serial number E7), provides no meaningful trust signal, as such certificates are routinely used by both legitimate and malicious sites. VirusTotal detection indicates that 2 of 94 security vendors flag the domain as malicious, a low but non-zero confirmation of its threat status. AlienVault OTX lists the domain in one threat intelligence pulse, suggesting limited but present visibility in automated threat-sharing platforms. Defenders should treat this domain as an active threat, particularly in environments where cryptocurrency or brand-sensitive interactions occur.