pioneer-porsche[.]com

Analysis of the domain pioneer-porsche.com indicates it is actively involved in a high-risk phishing campaign targeting users associated with the Porsche brand. Registered on May 15, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain resolves to the IP address 188.114.97.3, which is geolocated in Canada and associated with Cloudflare, Inc. infrastructure. The domain's nameservers, coleman.ns.cloudflare.com and cruz.ns.cloudflare.com, further confirm its reliance on Cloudflare services. The domain has been flagged by three of ninety-two security vendors on VirusTotal, a modest detection rate that suggests emerging recognition of its malicious intent. It is currently blocked by PhishDestroy and appears on one security blocklist, while AlienVault OTX has recorded its presence in a single threat intelligence pulse. The SSL certificate, issued by Let's Encrypt, does not mitigate the domain's risk, as phishing sites commonly use valid certificates to appear legitimate. The page title 'Just a moment...' is consistent with Cloudflare's interstitial page, which may be used to obscure the actual phishing content from automated scanners or casual inspection. The HTTP status code 403 (Forbidden) suggests the site may be restricting access to specific user agents or geolocations, a tactic often employed to evade detection. The domain's creation date, less than two months prior to this report, aligns with typical phishing lifecycle patterns, where domains are registered shortly before deployment. Defenders should treat this domain as an active threat. Network-level blocking of the IP 188.114.97.3 and the domain itself is recommended. Organizations should monitor for connections to this infrastructure, particularly in environments where Porsche-related communications are common. Further investigation into the domain's hosting provider and registrar may reveal additional linked infrastructure or patterns of abuse.