get-pippin[.]org

The domain get-pippin.org is currently active and has been classified as a high‑risk generic phishing site. The site presents itself with the page title “Pippin”, suggesting an attempt to masquerade as a legitimate service or brand named Pippin. No additional branding or visual cues have been disclosed, but the title alone is sufficient to lure users who expect an authentic Pippin portal. Infrastructure analysis shows the domain was registered on January 12 2026 and is hosted behind Cloudflare’s network. Authoritative nameservers jason.ns.cloudflare.com and rosa.ns.cloudflare.com resolve the domain to the IP address 104.21.25.109, which belongs to AS13335 Cloudflare, Inc., located in the United States. The site serves HTTPS traffic using a certificate issued by Google Trust Services under the WE1 root, confirming a valid TLS handshake. Threat intelligence sources corroborate the malicious classification. Gridinsoft assigns a trust score of 0 out of 100, and VirusTotal records a single security‑vendor detection out of 95 scans. The domain appears on four public blocklists and is actively blocked by PhishDestroy, MetaMask, ScamSniffer, and SEAL. HTTP response code 200 indicates the server is delivering content, reinforcing the suspicion that the site is operational. Defenders should treat get-pippin.org as a confirmed phishing vector. Immediate actions include enforcing URL filtering to block the domain at perimeter and endpoint layers, updating intrusion‑prevention signatures, and monitoring DNS queries for the associated Cloudflare nameservers. Continuous re‑evaluation is advised, as the short registration window and active hosting suggest the operators may adapt the site or launch additional clones.