ikhwancast[.]com

The domain ikhwancast.com was observed for the first time on September 13, 2025 and is currently listed as active with an elevated risk rating. Registration records show it was created through Hosting Concepts B.V. operating under the Registrar.eu brand, indicating a commercial registrar based in the European Union. Network resolution points the domain to the IP address 172.67.220.238, which is hosted on a content delivery network commonly used for legitimate traffic, complicating attribution of the underlying server infrastructure. Malware and phishing detection services have flagged the domain; VirusTotal reports 18 of 91 scanned security vendors marking it as malicious, and it appears on a single external blocklist.

The domain is also blocked by the PhishDestroy feed, reinforcing the suspicion of phishing use. No public page title, SSL certificate details, or HTTP response codes have been published in the available intelligence, leaving the exact content and login collection mechanisms unverified. The limited blocklist presence (one listing) suggests early‑stage deployment, and the modest detection count (18/91) may reflect either a newly registered domain or evasion techniques that have not yet triggered broader signatures. Observers should also query passive DNS services for historical A records to detect any prior pointings that could reveal a shift in hosting.

Consequently, analysts should treat any email or web interaction referencing ikhwancast.com as potentially malicious, enforce block rules at the DNS and proxy layers, and monitor for additional indicators such as newly observed IP addresses or certificate changes. Continuous observation of the hosting provider’s abuse channels is recommended to gather further forensic artifacts, and any traffic directed to the resolved IP should be logged for correlation with credential harvesting attempts.