icbc[.]com-hansz[.]cc

icbc.com-hansz.cc was registered through Gname.com Pte. Ltd. on June 12, 2026. The domain resolves to the IPv6 address 2606:4700:3031::ac43:91e3 and is served by Cloudflare name servers marty.ns.cloudflare.com and surina.ns.cloudflare.com. VirusTotal records show that 13 of 91 scanned security vendors flag the domain as malicious, indicating a consensus of detection across multiple AV engines. The domain is listed on one public security blocklist and is actively blocked by the PhishDestroy mitigation service, confirming that threat‑intelligence feeds consider it a phishing source.

The current risk rating is elevated and the operational status is active, meaning the infrastructure is still reachable. Analysis of the available data does not reveal additional attributes such as SSL certificate details, HTTP response codes, or page title content, as those elements have not been published in the intelligence set. Consequently, the exact phishing campaign payload, target brand, or lure technique remains unknown.

Defenders should treat any traffic to icbc.com‑hansz.cc as hostile. Recommended actions include adding the domain to local block lists, enforcing DNS‑level filtering, and ensuring that endpoint protection solutions reference the latest VirusTotal detections. Continuous monitoring of the IP address 2606:4700:3031::ac43:91e3 for new activity and periodic re‑query of VirusTotal and blocklist services are advised to capture any changes in the threat posture.