pikashow[.]or[.]at

Analysis indicates that pikashow.or.at is an active generic_phishing infrastructure flagged as high risk. The site resolves to the IPv6 address 2a06:98c1:3121::3 and is served through Cloudflare's network (AS13335, United States). DNS resolution uses Cloudflare nameservers armando.ns.cloudflare.com and paris.ns.cloudflare.com, and the TLS certificate is issued by Google Trust Services under the WE1 profile, confirming a valid HTTPS connection. The web stack comprises WordPress with MySQL, PHP, Yoast SEO, jQuery, jQuery Migrate, Google Analytics, and Cloudflare Browser Insights, all returning HTTP 200. VirusTotal reports two detections out of 91 scanners, and the domain appears on three external blocklists, with additional blocklisting by PhishDestroy, MetaMask, and SEAL. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. No content-level analysis is available beyond the page title "Pikashow APK Download Latest Version 2026 For Android," which suggests a lure for Android APK downloads. Defenders should treat the domain as hostile: block the domain and its resolving IP at perimeter defenses, add it to internal blocklists, and monitor for any outbound connections to the associated Cloudflare IP range. Continuous threat intel feeds should be consulted for updates, and any detection of related indicators of compromise should trigger response actions.