piggycore[.]xyz

Analysis of piggycore.xyz indicates that the domain was registered on 26 August 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com and is hosted on Cloudflare infrastructure (AS13335) at IP address 188.114.97.3, which geolocates to the United States. The authoritative name servers are dane.ns.cloudflare.com and naomi.ns.cloudflare.com. No TLS certificate was observed, implying that the site was reachable only over HTTP. VirusTotal records show that three of ninety‑five scanned security vendors flagged the domain as malicious, and the domain appears on a single external blocklist.

Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious assessment. The page title returned by the server is “Nur einen Moment…”, which provides no indication of the targeted brand or payload. The site was taken offline before the time of reporting and is currently listed as blocked by the PhishDestroy mitigation service.

Because the content has not been captured, the specific phishing vector, credential‑stealing mechanisms, or lure language remain unknown. Defenders should add the IPv4 address 188.114.97.3 and the domain name piggycore.xyz to deny‑list rules, monitor for any re‑registration or resurrection of the domain, and consider extending existing URL filtering policies to include the observed blocklist entry. Ongoing telemetry should be collected for any future DNS queries or HTTP requests targeting this domain to detect potential re‑use of the same infrastructure.