app[.]pinnaclerefp[.]com

Analysis indicates that the domain app.pinnaclerefp.com was registered on August 13 2025 through Cosmotown, Inc. The site resolves to the IPv4 address 198.12.66.123, which belongs to AS36352 (HostPapa) and is geolocated in the United States. Both authoritative nameservers listed for the domain are ns1.host-forest.com and ns2.host-forest.com. The TLS certificate presented is issued by Let’s Encrypt (R12), and the web server negotiates HTTP/3, suggesting a relatively recent deployment of modern protocols. The page title retrieved during the brief observation period was “Home -Pinnacle RFP”, and the domain is explicitly catalogued as impersonating the brand “across”.

The associated scam type is recorded as a crypto scam, a classification that aligns with the low Gridinsoft trust score of 0 / 100. The domain appears on a single security blocklist and is actively blocked by PhishDestroy. VirusTotal reports that 3 of 95 scanning engines flag the domain, providing independent confirmation of malicious intent. Current status shows the site taken offline, which limits direct verification of the payload or phishing lures that may have been hosted.

However, the combination of brand impersonation, crypto‑related scam labeling, low trust scoring, and multiple vendor detections strongly suggests that the domain was used to deceive victims and potentially harvest cryptocurrency‑related credentials or funds. Because the infrastructure shares an IP with HostPapa hosting services, other unrelated sites could be co‑located, so blocking the IP indiscriminately may cause collateral impact; instead, defenders should implement domain‑level deny‑list rules and monitor DNS queries for app.pinnaclerefp.com. Additional mitigation steps include adding the domain to local blocklists, configuring web‑gateway filters to drop TLS connections to the listed Let’s Encrypt certificate fingerprint, and continuing to watch for re‑registration attempts.