89906c6d9245efa4992639407d36cbc7[.]icu

The domain 89906c6d9245efa4992639407d36cbc7.icu is currently active and has been classified as a generic phishing site with a high risk rating. Infrastructure analysis shows the domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the IPv4 address 171.22.183.112, which is hosted by BlueVPS OU in the Netherlands. The authoritative name servers are ns3.my-ndns.com and ns4.my-ndns.com. The site presents an HTTP 403 Forbidden response and uses an SSL certificate issued to “Company / www.example.com”, indicating a possible certificate misuse. The domain is listed on a single security blocklist and has been blocked by the PhishDestroy service. VirusTotal scans report five out of ninety‑one security vendors flagging the domain as malicious. No additional content or landing page details have been observed beyond the 403 status. The available evidence confirms that the domain is being leveraged for phishing, but the specific target brand or credential‑capture vector has not been disclosed. Defenders should add the domain and its associated IP address to block lists, monitor DNS queries for the listed name servers, and consider enforcing TLS inspection to detect any future content changes. Continuous re‑evaluation is advised, as the threat actor may activate additional pages or modify the certificate usage.