p-in[.]cc

Analysis of p-in.cc confirms it as an active credential harvesting phishing domain. Registered on August 5, 2025, through NameSilo, LLC, the domain resolves to IP address 172.67.128.33, which is part of Cloudflare's infrastructure. The site employs HTTP/3 and HSTS, alongside Cloudflare Browser Insights, indicating an attempt to appear legitimate while leveraging content delivery network protections to evade takedowns. The page title 'Log In' suggests a generic login portal, though the specific brand or service being impersonated remains unconfirmed due to lack of deeper content analysis. Security vendors have flagged this domain: 10 of 95 engines on VirusTotal detect it as malicious. It appears on four security blocklists and is actively blocked by multiple threat intelligence feeds, including SEAL, MetaMask, PhishDestroy, and BLP-Malware. AlienVault OTX records the domain in 16 threat intelligence pulses, further corroborating its malicious status. The SSL certificate is issued by Google Trust Services, which, while not inherently suspicious, is commonly used by phishing sites to avoid immediate browser warnings. Defenders should treat p-in.cc as a high-risk domain. Network-level blocking is recommended, particularly for organizations where credential harvesting poses a significant threat. Monitoring for connections to 172.67.128.33 or domains registered via NameSilo with similar characteristics may help identify related threats. Given the domain's recent creation and active status, continued vigilance is advised until it is fully neutralized.