forty[.]icu

The domain forty.icu was registered on July 24, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. Its authoritative name servers are a.dnspod.com, b.dnspod.com and c.dnspod.com, indicating use of the DNSPod service. DNS resolution points the domain to the single IPv4 address 193.187.110.3. No additional A or CNAME records were observed at the time of analysis. Threat intelligence sources have classified the domain as a generic phishing site.

The classification is corroborated by its inclusion on one external security blocklist and by active blocking by the PhishDestroy service. A VirusTotal scan was submitted to 91 vendor engines; none returned a detection. The report explicitly notes that the lack of detections does not constitute evidence of legitimacy. No public SSL certificate details, HTTP response codes, or page titles were available during the investigation, and no references to known malware kits, compromised infrastructure, or attribution groups have been identified.

Consequently, the precise phishing campaign payload and target audience remain unknown. Defenders should prioritize adding forty.icu to domain deny lists and ensure that DNS resolvers are configured to block or sinkhole the address 193.187.110.3. Network traffic monitoring for outbound connections to this IP should be enabled, and any authentication attempts to URLs under the domain should be flagged for manual review. Given the recent registration date, the infrastructure may be short‑lived; continuous re‑evaluation of blocklist status and periodic re‑scans with multi‑engine services are recommended to capture any future changes in malicious behavior.