ictpartnerslows[.]ink

This domain, ictpartnerslows.ink, is currently under investigation for generic phishing activity. Analysis indicates the domain is active, though it returns a 404 Not Found response, suggesting either a placeholder or a cloaked infrastructure awaiting deployment of malicious content. No specific brand impersonation has been identified at this stage, but the domain exhibits characteristics consistent with phishing campaigns, including the use of a recently registered domain and Cloudflare hosting to obscure origin servers. Infrastructure analysis reveals the domain was registered on April 26, 2026, through NameCheap, Inc., a registrar frequently leveraged for malicious domains due to its accessibility and low cost. It resolves to the IP address 188.114.96.3, associated with AS13335 (Cloudflare, Inc.), a common tactic to evade detection and mitigate takedown efforts. As of the latest scan, 3 of 95 security vendors on VirusTotal have flagged the domain as malicious, and it appears on one security blocklist. The domain lacks an SSL certificate, further reducing its legitimacy and increasing the likelihood of interception or detection by security controls. The creation date, combined with the use of Cloudflare and absence of SSL, aligns with patterns observed in short-lived phishing campaigns. Current status remains active, though no functional phishing page is presently accessible. Organizations are advised to implement DNS-based blocking for ictpartnerslows.ink and its associated IP address, 188.114.96.3, at the perimeter level. Security teams should monitor for any changes in the domain’s behavior, particularly the deployment of content or redirection to known phishing kits. Given the domain’s recent registration and low detection rate, proactive monitoring of related infrastructure (e.g., subdomains, sibling domains registered via NameCheap) is recommended. End-users should be educated to report any unexpected communications referencing this domain, and security controls should be configured to log and alert on any attempts to access it.