auktacqaaaaaaakqclnqcai[.]icp0[.]io

This domain, auktacqaaaaaaakqclnqcai.icp0.io, is currently under investigation for phishing activity targeting users of the Internet Computer Protocol (ICP) ecosystem. Analysis indicates the domain returns an HTTP 400 error with the page title 'Canister ID Not Resolved - 400 | Internet Computer,' suggesting an attempt to exploit ICP's canister-based architecture. The domain was registered on September 6, 2022, through GoDaddy.com, LLC, and remains active as of July 12, 2026. It is flagged on one security blocklist, specifically PhishDestroy, and has a Gridinsoft trust score of 0 out of 100, reinforcing its suspicious classification. Infrastructure review reveals the domain employs a Let's Encrypt SSL certificate and enforces HTTP Strict Transport Security (HSTS), which may be leveraged to lend an appearance of legitimacy. However, no detections were recorded in VirusTotal's 95-engine scan, indicating either evasion of current detection mechanisms or recent activation of malicious intent. The absence of detections does not confirm benign status, particularly given the domain's presence on a security blocklist and its association with a known phishing classification. The exact nature of the phishing scheme remains unclear due to the lack of visible content analysis. The domain's structure, incorporating a lengthy, randomized subdomain prefix, is consistent with patterns observed in credential harvesting or fraudulent ICP canister deployments. Defenders should treat this domain as high-risk until further analysis confirms or refutes its malicious intent. Network-level blocking is recommended, particularly for environments interacting with Internet Computer Protocol services. Monitoring for connections to this domain should be prioritized, and any associated canister IDs or wallet addresses should be scrutinized for fraudulent activity.