3658nike5258[.]cc

The domain 3658nike5258.cc was registered through Dynadot Inc on 24 June 2026. Within weeks of creation it has been observed by multiple threat intelligence feeds. VirusTotal reports that 21 of 95 scanning engines flag the domain, indicating a high likelihood of malicious activity. The domain resolves to the IPv4 address 40.81.18.27, and both PhishDestroy and OpenPhish list it as a confirmed phishing indicator.

Two public blocklists also contain the hostname, and its authoritative nameservers are ns1.dns.com and ns2.dns.com. No public SSL certificate information, HTTP response codes, or page title data have been disclosed, so the current web payload cannot be described. The lack of additional infrastructure details such as ASN or hosting provider limits deeper attribution, but the convergence of multiple independent detections, a recent creation date, and active blocklist entries suggest the domain is being used for credential harvesting or similar phishing campaigns. Defenders should immediately add 3658nike5258.cc to URL filtering and DNS sink‑hole rules, deny outbound connections to 40.81.18.27 at the network perimeter, and monitor DNS query logs for any look‑ups of the domain or its nameservers.

Continuous re‑scanning of the host and periodic review of VirusTotal results are recommended to capture any evolution of the payload. Organizations that employ email security gateways should ensure that messages containing URLs to this domain are quarantined or rejected. Because the site is only a few weeks old, threat actors may expand the infrastructure; therefore, threat‑intel feeds should be polled for new indicators linked to the same IP or registrar.