aaincentive[.]us

This domain, aaincentive.us, is identified as a high-risk phishing site targeting Polish-speaking users with fraudulent discount offers. Analysis indicates the site presents itself as a legitimate retailer, advertising unrealistic discounts of 90–95% under the page title 'Oferta specjalna: 90–95% taniej.' The domain is currently offline but was actively used to deceive victims into disclosing personal or financial information under the guise of exclusive promotions. Infrastructure analysis reveals the domain was flagged by 18 of 95 security vendors on VirusTotal, indicating widespread detection as malicious. It resolves to the IP address 104.21.80.83 and employs Cloudflare’s content delivery network alongside HTTP/3 for enhanced performance and obfuscation. The SSL certificate is issued by Let’s Encrypt, a common tactic to appear trustworthy. The domain appears on six security blocklists, including those maintained by CERT-PL and PhishingArmy, further corroborating its malicious intent. The domain is currently offline, likely due to takedown efforts or operational changes by the threat actor. Organizations and users are advised to block the domain and its associated IP address at the network level. Security teams should monitor for related domains using similar naming conventions or infrastructure patterns. End-users who may have interacted with the site should be instructed to reset credentials, monitor financial statements for unauthorized activity, and report any suspicious transactions to relevant authorities.