hcdistrictclerk[.]lgsikaz[.]vip

Analysis of hcdistrictclerk.lgsikaz.vip indicates that the domain is actively used for phishing, as reflected by multiple threat intelligence sources. VirusTotal records show that 13 of 91 security vendors have flagged the domain, demonstrating a measurable detection rate across independent scanning engines. The domain resolves to the IP address 188.114.96.3 and is hosted on Cloudflare infrastructure, as evidenced by the authoritative nameservers frida.ns.cloudflare.com and malcolm.ns.cloudflare.com.

Registration data reveals that the domain was created on June 12, 2026 through Gname.com Pte. Ltd., a registrar that offers low‑cost bulk registrations, a pattern often observed in malicious campaigns. The domain appears on at least one public security blocklist and has been specifically blocked by the PhishDestroy service, confirming that external mitigation platforms have identified it as a threat. While the current data set does not include information on SSL certificate details, HTTP response codes, page title, or Safe Browsing status, the presence of vendor detections, blocklist listings, and active blocking by PhishDestroy provides sufficient confidence to classify the domain as a phishing vector.

Defenders should add the domain and its resolving IP to network deny lists, monitor for any outbound connections to the associated Cloudflare nameservers, and ensure that email and web filtering solutions reference the latest blocklists that include hcdistrictclerk.lgsikaz.vip. Continuous re‑evaluation is advised, as additional indicators such as page content or new vendor detections may emerge.