ny-pippin[.]xyz

Analysis of ny-pippin.xyz indicates that the domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com and created on 25 December 2025. The authoritative nameservers are chloe.ns.cloudflare.com and justin.ns.cloudflare.com, pointing to the Cloudflare edge IP 188.114.96.3, which is assigned to AS13335 Cloudflare, Inc. in the United States. No TLS certificate is present, meaning the site operates without HTTPS protection. The page title returned by the HTTP response is “Nur einen Moment…”, a generic German phrase that does not reveal the intended victim or lure. The domain has been observed in three AlienVault OTX pulses, indicating that it has been shared within threat‑intel communities.

VirusTotal scans show five of ninety‑three security vendors flagging the domain, confirming a modest detection rate. It is listed on one public blocklist and has been actively blocked by the PhishDestroy sink‑hole, and its current status is offline. While the available data confirms that ny-pippin.xyz is associated with a generic phishing campaign, the lack of a TLS certificate and the generic page title limit the ability to attribute a specific brand or credential‑stealing technique. No additional content, payload, or phishing kit details have been published, leaving the exact victim‑targeting vector uncertain.

Defenders should continue to monitor DNS queries for the Cloudflare IP address and enforce blocking of the domain at perimeter firewalls and proxy solutions. Adding the domain to internal blocklists, updating URL filtering services, and ensuring that endpoint protection products receive the latest indicator updates will reduce exposure. Because the infrastructure uses Cloudflare’s shared network, future variants may appear on adjacent IP ranges; therefore, organizations should consider applying broader Cloudflare edge‑IP controls when appropriate.