poleznoye[.]icu

Analysis of poleznoye.icu indicates a high‑risk, active generic phishing infrastructure. The domain was registered on February 21, 2026 and resolves to the IP address 162.220.208.138, which is geolocated to the United States and associated with Voonami, Inc. Nameserver delegation points to ns1.1reg.buzz and ns2.1reg.buzz, both typical of fast‑flux or bulk‑registration services. The SSL certificate presented is a generic sinkhole wildcard, offering no legitimate validation. HTTP requests return a 301 redirect, suggesting the site may forward victims to a malicious payload or credential‑harvesting page. Security telemetry shows the domain is flagged by three of ninety‑five VirusTotal scanners, receives a Gridinsoft trust score of 0 out of 100, and appears on a single security blocklist where it is listed as blocked by PhishDestroy. Given the combination of recent creation, low trust rating, sinkhole certificate, and detection by multiple vendors, defenders should block poleznoye.icu at DNS and proxy layers, monitor for any outbound connections to its resolved IP, and continue to ingest updates from threat‑intel feeds that reference this indicator. Ongoing observation is advised to detect any evolution of the phishing campaign or additional infrastructure linked to the same registrant or hosting environment.