gigfore[.]icu

This domain, gigfore.icu, is currently flagged as an active credential phishing site with a high risk level. Registered on April 29, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain resolves to IP address 172.67.186.179, hosted on Cloudflare infrastructure in Canada. Analysis of nameserver records reveals the use of Cloudflare DNS services (morgan.ns.cloudflare.com and vita.ns.cloudflare.com), a common tactic to obscure hosting origins and evade takedown efforts. The domain returns an HTTP 200 status, indicating it is operational, and holds a valid SSL certificate issued by Google Trust Services, which may lend an appearance of legitimacy to potential victims. As of July 12, 2026, the domain appears on one security blocklist and has been identified in a single threat intelligence pulse on AlienVault OTX. Detection engines on VirusTotal flag the domain as malicious, with 15 out of 91 security vendors marking it as phishing-related. The Gridinsoft trust score of 0/100 further corroborates its classification as a high-risk threat. No specific brand impersonation or phishing kit details have been confirmed at this time, and the exact content of the site remains unanalyzed. Defenders should prioritize blocking this domain at the DNS and network levels, particularly given its association with Cloudflare, which may complicate traditional IP-based blocking strategies. Monitoring for related domains registered through NICENIC INTERNATIONAL GROUP CO., LIMITED or utilizing the same nameserver infrastructure may help identify additional threats. Given the domain's recent registration and active status, it is likely part of an ongoing campaign, and further intelligence gathering is recommended to assess its full scope.