4s63n-5iaaa-aaaaj-az5tq-cai[.]icp0[.]io

Analysis of the domain 4s63n-5iaaa-aaaaj-az5tq-cai.icp0.io shows a high‑risk generic phishing infrastructure that remains active as of 12 July 2026. The site presents a valid HTTPS certificate issued by Let’s Encrypt (E7), and HTTP responses return status 200, indicating a functional web server. Front‑end technologies detected include React and enforced HSTS, which are typical of modern phishing pages designed to appear legitimate. DNS resolution is handled by Cloudflare (karina.ns.cloudflare.com, clay.ns.cloudflare.com), and the domain resolves to the IPv6 address 2600:3007:4401:100:bced:b7ff:feca:1322, which is hosted within the Flexential Colorado Corp. network (AS13649) in the United States. Registration data reveals the domain was created on 21 February 2026 through GoDaddy.com, LLC, and the domain name itself does not correspond to any known legitimate brand; the page title returned is “BQ Labs,” but no further content analysis is available. The domain has been flagged by at least one external blocklist (PhishDestroy) and receives a Gridinsoft trust score of 0 / 100, indicating a strong malicious reputation. VirusTotal reports three of ninety‑three scanning engines flag the domain, reinforcing the suspicion of phishing activity. While the exact payload or credential‑harvesting mechanism has not been observed, the combination of a recent creation date, active TLS, modern web stack, and multiple security vendor detections supports the classification as a high‑confidence phishing host. Defenders should add the IPv6 address and domain to deny‑list rules, enforce outbound filtering to block connections, and monitor DNS queries for related Cloudflare name‑servers. Continuous threat‑intel feeds should be consulted for any emerging indicators, and incident response teams should be prepared to investigate any logged user interactions with the site.