3658e104[.]cc

Analysis of the domain 3658e104.cc shows an active malicious infrastructure that surfaced on May 03 2026. The domain is registered through Dynadot Inc. and resolves to the IPv4 address 52.184.80.75. It is served under a Let's Encrypt R12 certificate, which indicates the presence of a valid TLS certificate but does not mitigate the risk associated with the site. Nameserver records point to ns1.1233dns.com and ns2.951dns.com, both of which are frequently observed in other abuse cases and reinforce the suspicion that the domain is part of a disposable hosting setup. VirusTotal has recorded 12 detections out of 95 security scanners, confirming that a subset of reputable vendors have identified the site as malicious. The domain appears on at least one external blocklist and is already listed by the PhishDestroy service, which has taken it down in its own feed. No public page title, brand target, or kit information is currently available, so the exact phishing lure remains unknown. Defenders should add 3658e104.cc to firewall and DNS filtering policies, block the associated IP address 52.184.80.75, and monitor any outbound connections to that host. Continued observation of the hosting provider and nameservers is advised, as changes may indicate shifts in the campaign’s infrastructure.