cici606[.]net

The domain cici606.net was registered on 08 December 2025 through NameSilo, LLC and is currently resolved to the IPv4 address 151.241.30.74. The domain remains active as of the report date 06 August 2026 and is listed on one external security blocklist. Reputation data from VirusTotal shows that five out of ninety‑one scanning engines have flagged the domain, indicating a non‑trivial detection rate for malicious activity. The domain is also explicitly blocked by the PhishDestroy service, reinforcing the assessment of phishing risk.

Nameserver configuration includes ns1.cici606.net, ns2.cici606.net and two ancillary records ns1.ultahooosttts.icu and ns2.ultahooosttts.icu, suggesting a split‑hosting set‑up that may be used to increase resilience or evade takedown efforts. The available evidence points to a generic phishing campaign, but the specific target or lure employed by cici606.net has not been observed in the current intelligence set. Consequently, the precise payload or credential‑ harvesting method remains uncertain. Defenders should add 151.241.30.74 to network‑level deny lists and enforce DNS filtering for cici606.net on endpoint and gateway solutions.

Monitoring for additional hostnames that resolve to the same IP, as well as any new entries on blocklists that reference the domain, will help to capture potential expansion of the infrastructure. Because the registrar is NameSilo, investigators may consider requesting registration details from the registrar if further attribution is required. In summary, the combination of recent creation, active resolution, multiple vendor detections, and inclusion on a dedicated phishing blocklist makes cici606.net a high‑risk indicator that should be blocked and continuously monitored.