help-hub-desktop---ledgar[.]mypixieset[.]com

Analysis of the domain help-hub-desktop---ledgar.mypixieset.com indicates a high‑risk generic phishing operation. The site was created on February 21, 2026 and is currently listed as active. Its primary objective appears to be credential harvesting, as inferred from the page title “Pixieset” and the placement of the domain within a known phishing blocklist.

The domain is registered through Cloudflare, Inc., using the authoritative name servers lady.ns.cloudflare.com and tom.ns.cloudflare.com. DNS resolution points to the IP address 104.19.187.93, which belongs to AS13335 operated by Cloudflare, Inc. The host resides in the United States and presents an SSL certificate issued by Google Trust Services under the WE1 intermediate, indicating a valid TLS handshake despite malicious intent. An HTTP request to the root returns a 403 status, suggesting the front‑end is deliberately concealed while further malicious pages may be served to targeted victims.

Threat intelligence sources show that the domain is present on a single security blocklist and has been flagged by PhishDestroy. VirusTotal analysis reports that 1 of 95 security vendors have raised a detection for this domain, and Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. The low detection count on VirusTotal does not diminish the risk, as the infrastructure—namely Cloudflare’s CDN—can obscure traffic and hamper attribution.

Defenders should implement immediate blocking of the fully qualified domain name and its associated IP address at network perimeter devices. Monitoring of DNS queries for the Cloudflare name servers used by this domain can provide early warning of additional phishing hosts that may reuse the same registration pattern. Continuous re‑evaluation of VirusTotal and blocklist feeds is advised, as further detections may emerge as the campaign evolves.