pinkotopcas[.]xyz

Analysis of pinkotopcas.xyz shows a recently created (June 12, 2026) domain hosted behind Cloudflare infrastructure (nameservers emily.ns.cloudflare.com and ernest.ns.cloudflare.com, IP 188.114.96.3 located in Canada). The site presents an HTTP 403 response and a page title of “Just a moment…”, indicating a potential content delivery or redirection mechanism. SSL is issued by Google Trust Services under the WE1 certificate, confirming the use of a valid TLS certificate. Technical fingerprinting identified AMP, Lightbox, Cloudflare and HTTP/3, all consistent with a modern delivery stack. Intelligence sources record the domain on one security blocklist, in a single AlienVault OTX pulse, and it is actively blocked by PhishDestroy. Gridinsoft assigns a trust score of 0/100, reinforcing the malicious assessment. The threat type is catalogued as generic_phishing with a specific classification of credential phishing. While no public content has been captured, the combined indicators – recent registration, cloud‑based hosting, valid TLS, blocklist presence, and attribution to credential phishing – justify treating the domain as a confirmed phishing infrastructure. Defenders should add pinkotopcas.xyz to URL filtering and DNS deny lists, monitor outbound connections to its IP, and apply outbound email controls to block any credential‑collection attempts that reference the domain. Continuous log review for connections to the Cloudflare edge IP is advised, and any related alerts should be escalated for incident response.