pikashowapp[.]video

This domain, pikashowapp.video, is flagged as a high-risk phishing site specializing in fake APK distribution. Analysis indicates the site impersonates the official Pikashow Android application portal, offering a counterfeit version labeled 'Pikashow APK Download v92 For Android (Official Site) 2026.' The page title and branding are designed to deceive users into downloading malicious software under the guise of a legitimate app update, a common tactic in mobile malware distribution campaigns. Infrastructure analysis reveals the domain was registered on April 1, 2026, through Spaceship, Inc. It resolves to the IP address 104.21.24.215, which is proxied through Cloudflare, obscuring the true origin of the hosting infrastructure. Security vendor detections on VirusTotal stand at 14 out of 95, with additional flags from Gridinsoft assigning a trust score of 0 out of 100. The domain appears on four security blocklists and is blocked by multiple threat intelligence feeds, including MetaMask, PhishDestroy, SEAL, and OISD. The SSL certificate is issued by Let’s Encrypt, a common but not exclusive indicator of legitimate sites, though often exploited by malicious actors to lend false credibility. AlienVault OTX records the domain in two threat intelligence pulses, further corroborating its malicious classification. As of the latest assessment, pikashowapp.video has been taken offline, likely due to enforcement actions by hosting providers or domain registrars. However, the infrastructure remains a residual risk, as threat actors may re-deploy the domain or migrate the phishing kit to a new address. Users who interacted with the site prior to takedown are advised to scan their devices for malware, revoke any installed APKs, and monitor for unauthorized activity. Organizations should update blocklists to include this domain and its associated indicators, including the IP 104.21.24.215 and registrar details, to prevent future exposure.