calcexc[.]app

PhishDestroy identifies calcexc.app as an active credential phishing domain masquerading as a calculator application to harvest user login details. This domain, registered on July 03, 2025, through NICENIC INTERNATIONAL GROUP CO., LIMITED, resolves to IP 188.114.96.3 and currently shows zero detections on VirusTotal out of 95 security engines scanned. The presence of a valid Google Trust Services SSL certificate may be leveraged to enhance trustworthiness, potentially tricking users into entering sensitive information under false pretenses.

Technical analysis reveals minimal blocklist coverage despite suspicious characteristics, with no detections registered across VirusTotal's sandbox and antivirus platforms. The domain's recent creation date—just days ago—coupled with its minimal detection footprint, suggests it may be a newly deployed campaign in its early stages. Attackers frequently exploit newly registered domains to evade existing security measures, making this a critical window for proactive defense.

Users who have interacted with calcexc.app by downloading content, entering credentials, or signing in should immediately cease further interaction. If credentials were entered, change passwords immediately and enable multi-factor authentication where possible. Report the domain to your security team or block it via DNS or firewall rules using the IP 188.114.96.3. Monitor accounts for unusual activity and consider running a malware scan. Organizations are advised to update threat intelligence feeds and network defenses to include this indicator of compromise (IOC) to prevent lateral spread. This advisory will be updated as new intelligence emerges.