play-pixels[.]online

On July 24 2026 the domain play-pixels.online was observed offline but retained evidence of a phishing infrastructure. The site previously returned HTTP 200 with the page title “Pixels Login”, suggesting a credential‑harvesting landing page. DNS resolution pointed to the IPv6 address 2a00:f940:2:2:1:1:0:297, which is hosted in Russia and associated with AS197695 operated by Domain names registrar REG.RU Ltd. The domain was registered through REGRU‑RU on 21 February 2026, indicating a very recent creation window. Nameserver records list ns1.hosting.reg.ru and ns2.hosting.reg.ru, both belonging to the same registrar, confirming the hosting relationship.

Reputation checks show a Gridinsoft trust score of 0 out of 100, and the domain appears on three independent security blocklists, including PhishDestroy, ScamSniffer and Enkrypt. VirusTotal analysis recorded two positive detections out of ninety‑three scanned vendors, reinforcing the malicious classification. The TLS certificate presented by the site is issued by GlobalSign nv‑sa under the GlobalSign GCC R6 AlphaSSL CA 2025, a legitimate certificate authority, which does not mitigate the phishing risk. The combination of a fresh registration, low trust score, blocklist presence, and positive vendor detections provides strong evidence that play-pixels.online was used for credential‑stealing activity.

Current uncertainty remains around the exact phishing kit or target brand, as the page title offers no further context. Defenders should continue to block the domain at network perimeters, monitor the associated IPv6 address for any re‑activation, and add the domain to internal deny lists. Ongoing observation of the registrar’s name servers may reveal future re‑use of the same infrastructure.