pippin[.]tools

Analysis of pippin.tools indicates that the domain was actively used for a phishing operation before being taken offline. The site was registered on February 21, 2026 through NiceNIC International Group Co., Limited and resolved to the Cloudflare edge address 172.67.165.156, belonging to ASN 13335 (Cloudflare, Inc.) in the United States. The TLS certificate presented was issued by Google Trust Services under the WE1 trust hierarchy, which is typical for Cloudflare‑protected sites and does not provide assurance about the underlying content. An HTTP request returned a 403 status code and the page title displayed “Suspected phishing site | Cloudflare”, confirming that the hosting provider flagged the content as malicious.

Automated scans on VirusTotal recorded nine detections out of ninety‑five scanners, and the domain appears on two public blocklists, specifically PhishDestroy and ScamSniffer. AlienVault OTX references the domain in a single threat‑intel pulse, further corroborating its association with phishing activity. The infrastructure utilizes HSTS, HTTP/3, and standard Cloudflare services, indicating a modern web stack but offering no insight into the payload or targeted brand. No additional content analysis is available, and the specific phishing kit or targeted brand has not been disclosed in the collected data.

Because the site is currently offline, active exploitation cannot be confirmed, yet the combination of multiple vendor detections, blocklist listings, and the explicit “Suspected phishing” page title provides strong evidence of malicious intent. Defenders should continue to block the domain at perimeter filters, monitor DNS queries for the associated IP address and nameservers (candy.ns.cloudflare.com, amos.ns.cloudflare.com), and ensure that any historic credentials potentially exposed by this site are rotated.