pickpdf[.]top

Analysis of pickpdf.top indicates this domain was actively used for phishing targeting the United States Social Security Administration (SSA), as evidenced by its page title 'The United States Social Security Administration | SSA'. The domain was registered on March 11, 2026, through Cosmotown and is currently offline, though it remains flagged by at least one security blocklist and was previously blocked by PhishDestroy. Infrastructure review reveals the domain resolved to 192.142.54.88, hosted on AS214036 (Ultahost, Inc.) in the Netherlands, with nameservers ns1.hostcreed.com and ns2.hostcreed.com. The site used a Let's Encrypt SSL certificate (R12) and LiteSpeed web server technology with HTTP/3 support, which are common in both legitimate and malicious infrastructure.

Two of ninety-five security vendors on VirusTotal flagged the domain, though this detection rate alone does not confirm malicious intent without additional context. The presence of a single MX record with the domain itself as the host (priority 0) suggests minimal or misconfigured email infrastructure, often seen in short-lived phishing operations. Defenders should treat this domain as high-risk for SSA-themed credential harvesting or fraudulent benefit claims, particularly given its offline status may indicate evasion rather than remediation.

No evidence confirms whether stolen data was exfiltrated or if the site used a known phishing kit. Organizations should monitor for connections to 192.142.54.88, the hostcreed.com nameservers, and any SSL certificates issued to pickpdf.top, while treating any future reactivation as a critical threat. The domain's creation date and rapid takedown align with typical phishing campaign lifecycles, warranting proactive blocking of related infrastructure.