aqy[.]dot02ig[.]cfd

This domain, aqy.dot02ig.cfd, is flagged as a high-risk phishing site specializing in cryptocurrency wallet credential theft. Analysis indicates the infrastructure is designed to mimic legitimate wallet interfaces, likely targeting users of decentralized finance platforms or exchange services. No specific brand impersonation or drainer kit has been conclusively identified, but the domain's structure and recent creation suggest a focus on rapid deployment and evasion of detection mechanisms. Infrastructure analysis reveals the following technical indicators: the domain was registered on May 04, 2026, through DYNADOT LLC, a registrar frequently associated with high-volume domain registrations for malicious purposes. It resolves to the IP address 47.243.75.190, hosted on infrastructure previously linked to other phishing campaigns. The domain is flagged by 3 out of 95 security vendors on VirusTotal, indicating early detection but limited widespread awareness. The SSL certificate is issued by Let's Encrypt, a common tactic to lend superficial legitimacy to phishing sites. As of this assessment, the domain remains unlisted on Google Safe Browsing (GSB) and has minimal presence on public blocklists, suggesting it is still in the early stages of deployment. The domain remains active and poses a significant risk to users who may encounter it through phishing links distributed via email, social media, or malicious advertisements. Response actions should include immediate reporting to hosting providers and certificate authorities to revoke SSL credentials and suspend associated infrastructure. Users are advised to verify domain authenticity before entering sensitive credentials, enable multi-factor authentication on all financial accounts, and monitor for unauthorized transactions. Despite low initial detection rates, the domain's infrastructure and registration patterns align with known phishing tactics, warranting continued monitoring and proactive mitigation efforts.