pippkln[.]fun

Analysis indicates that the domain pippkln.fun was registered on 27 February 2026 through NiceNIC International Group Co., Limited and is currently hosted on Cloudflare infrastructure (ASN 13335) with the IP address 104.21.41.91 located in the United States. The domain resolves to that IP and presents a web page whose title is “PIPPPKIN THE HORSE”. No TLS certificate was observed, meaning the site served HTTP only. VirusTotal has recorded detections from 2 of 93 scanned vendors, confirming that at least a subset of security products consider the domain malicious.

The domain appears on two public phishing blocklists, specifically PhishDestroy and ScamSniffer, reinforcing the classification as a phishing resource. The nameservers courtney.ns.cloudflare.com and yichun.ns.cloudflare.com are typical of Cloudflare‑managed domains. The site is presently taken offline, which limits immediate observation of payloads or credential‑harvesting forms, and the exact content of the page beyond the title has not been captured.

Because the page title does not reveal a targeted brand, the specific victim lure remains unclear, and investigators should treat the domain as a generic phishing vector until further content analysis is possible. Defenders should block the domain and its associated IP address at perimeter firewalls, update URL filtering lists with the two blocklist identifiers, and monitor for any new subdomains that resolve to the same Cloudflare IP range. Additional investigation, such as requesting a full HTTP archive from a sandbox or retrieving historic snapshots from web archives, would be required to determine the exact credential‑stealing mechanism and any potential data exfiltration paths.