ictlowpartners[.]ink

This domain, ictlowpartners.ink, is identified as a generic phishing threat designed to harvest user credentials through deceptive Cloudflare-branded interfaces. Analysis indicates the site employs social engineering tactics, presenting itself as a legitimate service to trick users into submitting sensitive login information. The infrastructure leverages Cloudflare Browser Insights and HTTP/3, which are often abused to lend credibility to malicious pages while obscuring the true origin of the attack. Evidence supporting the malicious classification includes detection by 5 out of 95 security vendors on VirusTotal, registration through NameCheap, Inc., and a creation date of May 20, 2026, which is unusually recent for a domain resolving to a 404 page. The domain appears on one security blocklist and resolves to the IP address 104.21.16.207. Despite its current offline status, the domain's infrastructure and registration details align with known phishing campaigns targeting enterprise and cloud service users. Users who visited ictlowpartners.ink should immediately revoke any credentials entered on the site, as they may have been compromised. Monitor accounts associated with the submitted credentials for unauthorized access or suspicious activity. Network administrators should block the domain and its resolving IP (104.21.16.207) at the perimeter to prevent further exposure. If the domain was accessed in a corporate environment, initiate an incident response procedure to assess potential data exposure and mitigate risks.