pippinreward[.]xyz

Analysis of pippinreward.xyz, registered through NiceNIC International Group Co., Limited on 21 February 2026, shows an active infrastructure typical of a short‑lived phishing operation. The domain resolves to the Cloudflare edge address 188.114.96.3, which is announced by AS13335 (Cloudflare, Inc.) and is geolocated to the United States. The site presented the generic page title “Just a moment…”, a pattern often used to delay browsers while loading malicious payloads; no further page content has been captured because the service is currently taken offline. TLS termination is provided by Google Trust Services under the WE1 certificate, indicating a valid HTTPS certificate issued by a trusted root. DNS is served by Cloudflare’s nameservers bryce.ns.cloudflare.com and imani.ns.cloudflare.com, and traffic is delivered over HTTP/3 with Cloudflare Browser Insights enabled.

Reputation signals are consistent with a malicious campaign. The domain appears on two independent blocklists—PhishDestroy and ScamSniffer—and five of ninety‑three VirusTotal scanners flagged it as malicious. The observed scam type is a “Fake Airdrop”, a social‑engineering lure that promises cryptocurrency rewards in exchange for credential submission. No additional indicators such as specific phishing kits or compromised brand assets have been disclosed.

Defenders should immediately block DNS resolution for pippinreward.xyz and the associated IP 188.114.96.3, add the domain to intrusion‑prevention and web‑filter policies, and monitor for newly registered domains that share the same registrar or similar naming patterns. Given the Cloudflare front‑end, threat actors may shift the payload to alternative edge nodes, so continuous re‑evaluation of the IP range for similar activity is advised. Logging of TLS handshake metadata and HTTP/3 traffic can aid in detecting reuse of the same certificate or browser‑insight identifiers.