pippin[.]plus

Analysis indicates that the domain pippin.plus is currently active and associated with a high‑risk generic phishing campaign. The site returns an HTTP 403 status code, which suggests that legitimate users are being blocked while automated tools may still access malicious resources. The page title observed is "Nur einen Moment…", providing no clear indication of legitimate content and further supporting the suspicion of deceptive intent.

Infrastructure analysis reveals that pippin.plus resolves to the IP address 188.114.96.3, which is hosted by a major content delivery network operating under AS13335. The domain is registered through the same provider that supplies the DNS service, and the authoritative nameservers are lovisa.ns.cloudflare.com and noel.ns.cloudflare.com. An SSL certificate issued by a widely trusted certificate authority is present, indicating that the site employs HTTPS encryption, a common tactic used by threat actors to gain user confidence.

Threat indicators include a Gridinsoft trust score of 0 out of 100, placement on a security blocklist, and detection by PhishDestroy. VirusTotal analysis shows that 2 out of 95 security vendors have flagged the domain, reinforcing the presence of malicious activity despite a limited consensus among scanners. The combination of a low trust score, blocklist inclusion, and active detection by specialized anti‑phishing services provides concrete evidence of the domain’s abusive nature.

Defenders should block network traffic to pippin.plus at the perimeter and update internal threat intelligence feeds with the observed indicators of compromise. Continuous monitoring of DNS queries for the associated nameservers and the resolved IP address is recommended to detect any pivoting activity. Users should be warned against interacting with the domain, and any credential submissions that may have been directed to the site should be treated as compromised and forced to change passwords immediately.