domatisc[.]ink

Analysis on domatisc.ink shows that the domain was registered on April 24, 2026 through NameCheap, Inc. The domain resolves to the IP address 104.21.28.137, which is hosted on a cloud‑based service commonly used by threat actors. VirusTotal has recorded detections from 20 of 91 scanning engines, indicating that multiple security products have identified malicious behavior associated with the host. The domain appears on a single public blocklist and is actively blocked by the PhishDestroy threat‑intelligence feed, confirming its inclusion in known phishing infrastructure.

No public page title, SSL certificate details, or HTTP response codes have been disclosed, leaving the exact content and lure technique unverified. Consequently, the precise brand or service being spoofed cannot be confirmed at this time. Defenders should add 104.21.28.137 to network‑level deny lists, enforce DNS sink‑holing for domatisc.ink, and ensure that endpoint detection and response solutions are updated to reflect the 20 vendor detections.

Continuous monitoring of the IP address for additional malicious activity is advised, as well as periodic re‑scanning of the domain through sandbox environments to capture any payloads that may be delivered when the site becomes active. Organizations that employ email filtering should keep the domain on phishing‑block lists and consider raising the alert severity for any messages that reference the domain, given its elevated risk rating. Since the domain’s content has not been publicly catalogued, threat hunters should treat any traffic to the host as suspicious until further forensic evidence is obtained.