pik303[.]com

The domain www.pik303.com was registered on November 03, 2025 through Dynadot LLC and is currently resolved to the Cloudflare IP address 104.21.8.237, which belongs to ASN 13335 (Cloudflare, Inc.) and is geolocated in the United States. The site operated behind Cloudflare’s infrastructure, supporting HTTP/3, and presented the page title "Attention Required! | Cloudflare". An SSL certificate issued by Google Trust Services (WE1) was observed, indicating a valid TLS layer despite the malicious intent.

The domain appears on a single external security blocklist and has been explicitly blocked by the PhishDestroy service. VirusTotal analysis recorded a single positive detection out of 93 security vendors, confirming that at least one vendor deemed the domain malicious. When accessed, the server responded with HTTP status code 403, and the site has since been taken offline, as reflected by its current status flag.

The combination of a recent creation date, use of a reputable CDN, a valid TLS certificate, and the presence on a blocklist suggests a purposeful attempt to host a phishing campaign, likely leveraging Cloudflare’s challenge page to obscure the underlying payload. Defenders should add www.pik303.com to deny‑lists across web‑filtering and endpoint protection solutions, block traffic to its resolving IP 104.21.8.237, and monitor for additional domains that resolve to the same Cloudflare nameservers (anirban.ns.cloudflare.com, mina.ns.cloudflare.com). Continuous observation of the registrar Dynadot for new registrations with similar patterns is also advised, as well as periodic re‑scanning of the domain should it become active again.