ppd[.]cpi[.]mybluehost[.]me

This domain, ppd.cpi.mybluehost.me, is flagged as an active phishing threat with high-risk indicators. Registered on March 22, 2026, through a commercial registrar, it resolves to IP address 50.6.34.104, hosted on infrastructure associated with Oracle Corporation in Germany. The domain is currently active, returning an HTTP 302 redirect status, which is commonly used in phishing campaigns to obscure final landing pages or evade detection. Infrastructure analysis reveals the use of WordPress, PHP, MySQL, and Nginx, alongside common web technologies such as jQuery and Yoast SEO, suggesting a standard but potentially compromised web stack. Security vendors have flagged the domain, with 8 out of 94 engines detecting malicious activity, though the specific nature of the phishing content remains unconfirmed. The domain appears on at least one security blocklist and is actively blocked by enterprise phishing protection systems. SSL certification is provided by Let’s Encrypt, a common choice for both legitimate and malicious sites due to its free and automated issuance process. Nameservers are hosted under mybluehost.me, a subdomain of a known hosting provider, which may indicate the use of shared or reseller hosting infrastructure. MX records point to mail.ppd.cpi.mybluehost.me, suggesting the domain may be used for email-based phishing or credential harvesting. The page title, 'Welcome -', provides no specific brand or target information, and no confirmed phishing kit or impersonated entity has been identified in available data. Defenders should treat this domain as a confirmed phishing threat, block resolution at the DNS level, and monitor associated IP and hosting infrastructure for related activity. Further analysis of the redirect chain and final landing page is recommended to determine the exact phishing methodology and potential brand impersonation.