contact[.]global-icann[.]com

PhishDestroy identifies contact.global-icann.com as an active credential phishing domain impersonating ICANN’s official login portal, leveraging a spoofed page titled 'Sign in to ICANN Account' to harvest user credentials. The domain employs a generic ICANN-branded phishing kit designed to trick visitors into entering their account details under the false pretense of account verification or access restoration. The page structure and branding closely mimic legitimate ICANN authentication flows, increasing the risk of successful deception, especially among non-technical users or those expecting routine correspondence from domain authorities.

Technical analysis reveals this domain resolves to IP 188.114.97.3 and is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain was created on April 13, 2026—an unusually recent date that suggests opportunistic registration following ICANN-related campaigns. Despite being undetected by VirusTotal (3/95 engines), the domain utilizes a valid Let’s Encrypt SSL certificate, which may enhance credibility by enabling HTTPS and displaying the padlock icon. At the time of analysis, the domain has not been flagged by Google Safe Browsing (GSB) and remains absent from major blocklists, indicating a low detection footprint and potential for continued operation.

This domain is currently flagged as ACTIVE with a status of UNDER_INVESTIGATION. While no takedown or blocklisting actions have been confirmed, its low detection rate and recent registration raise the risk of sustained phishing operations. Users are advised to avoid entering credentials or personal information on this site and to verify domain authenticity by accessing official ICANN portals directly via verified URLs. Security teams should monitor for further abuse and consider reporting to ICANN’s abuse channels and hosting providers. Remaining risk is assessed as moderate due to active phishing capabilities and undetected status, emphasizing the need for proactive user education and rapid response measures.