carnavalpix[.]com

Analysis of the domain carnavalpix.com shows a recently registered internet address, created on February 21, 2026, that is presently taken offline. The domain is hosted by Hostinger operations, UAB, and resolves to the IPv4 address 169.197.142.118, which is announced by AS63023 belonging to GTHost and geolocated to the United States. DNS resolution is served by Cloudflare name servers alec.ns.cloudflare.com and ines.ns.cloudflare.com. No TLS certificate is present, indicating that the site does not support HTTPS.

The page title returned from the last known HTTP response is "Gira Pix," but no further content has been captured. Threat intelligence indicates the site is being used for social media phishing, a classification corroborated by its inclusion in a single security blocklist and a block by the PhishDestroy service. VirusTotal scans report that nine of ninety‑five security vendors flagged the domain, reinforcing the suspicion of malicious activity. Additionally, AlienVault OTX lists the domain in one threat‑intel pulse, providing an external confirmation of its malicious reputation.

While the offline status limits direct observation of the payload or credential‑harvesting mechanisms, the combination of recent registration, absence of encryption, a phishing‑oriented page title, and multiple vendor detections suggests a purposeful campaign targeting social‑media users. Defenders should continue to block the domain at DNS and proxy layers, monitor for any re‑appearance of the host, and consider adding the IP address to network‑wide deny lists. Ongoing vigilance is advised to detect any future infrastructure reuse, and any observed traffic to the domain should be logged for forensic correlation with other social‑media phishing incidents.