multisig-nodekit-api[.]icu

This domain, multisig-nodekit-api.icu, presents itself as a "Quiz App with React + GSAP," a legitimate web application framework. However, the domain is likely a decoy or a malicious site designed to host phishing or malware distribution infrastructure, given its suspicious registration and lack of operational content. The threat posed includes potential credential harvesting or serving as a command-and-control endpoint, though the specific payload is unconfirmed.

Technical evidence shows the domain has 3 detections out of 95 VirusTotal vendors, flagged by Forcepoint ThreatSeeker, Fortinet, and SOCRadar. It appears on 3 blocklists. The domain was registered on 2026-02-25 through NiceNIC International Group Co., Limited, a registrar often associated with low-reputation domains. It resolves to IP 188.114.96.3, located in the US and hosted by AS13335 Cloudflare, Inc. No SSL certificate is present. The nameservers are everton.ns.cloudflare.com and jo.ns.cloudflare.com.

The site is currently offline or unreachable. The risk level is moderate due to the low detection rate and the combination of a recent registration, a registrar known for questionable domains, and the presence on blocklists. The absence of SSL and the domain being down reduce immediate exploitation risk, but the infrastructure remains a potential threat if reactivated.