snr42-qiaaa-aaaao-a3fpq-cai[.]icp0[.]io

This domain, snr42-qiaaa-aaaao-a3fpq-cai.icp0.io, is flagged as an active cryptocurrency phishing site. Analysis indicates it was registered on September 6, 2022, through GoDaddy.com, LLC, and remains operational as of July 12, 2026. The domain resolves to an IPv6 address (2602:fb2b:110:1:bcfb:b8ff:fe09:c741) hosted under AS398485, associated with DFINITY USA Research, LLC in Germany. The page title, 'relinkd,' does not correspond to a known legitimate service, and the site is classified as a cryptocurrency scam based on available intelligence. Infrastructure analysis reveals the use of Cloudflare nameservers (clay.ns.cloudflare.com, hassan.ns.cloudflare.com, karina.ns.cloudflare.com, lara.ns.cloudflare.com) and a Let's Encrypt SSL certificate (serial number E7). The domain is currently blocked by at least one security vendor, and eight out of ninety-five security engines on VirusTotal have flagged it as malicious. The HTTP status code 200 confirms the site is accessible, and technologies such as HSTS and Crazy Egg are detected, suggesting efforts to enhance security and track user interactions. The exact nature of the cryptocurrency scam remains unconfirmed, as the page content has not been fully analyzed. However, the combination of a non-standard domain structure, cryptocurrency targeting, and detection by multiple security vendors indicates a high-risk threat. Defenders should treat this domain as malicious and prioritize blocking it at the network level. Monitoring for related domains or subdomains under the same infrastructure may also help identify additional threats. Given its active status and consistent detection, this domain should be considered a persistent risk for users engaging with cryptocurrency platforms.