rekorbet-bul[.]icu

The domain rekorbet-bul.icu was registered on 21 June 2026 and is currently active. DNS resolution points to 104.21.94.170, a Cloudflare‑owned address located in Canada. The authoritative nameservers are matteo.ns.cloudflare.com and wally.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. TLS is provided by Google Trust Services under the WE1 certificate, and the site serves HTTP/3 traffic. An HTTP request returns a 403 status code and the page title reports “FASTPANEL”, suggesting the presence of a generic control‑panel front end. Reputation scoring is extremely low, with Gridinsoft assigning 0 / 100. The domain is listed on at least one public blocklist, has been blocked by the PhishDestroy service, and appears in a single AlienVault OTX pulse. VirusTotal analysis shows three of ninety‑one scanners flagging the domain, reinforcing the malicious assessment. The threat is classified as credential phishing, targeting user credentials. No additional indicators such as payload samples or observed phishing lures are publicly available, leaving the exact phishing vector unconfirmed. Defenders should add rekorbet-bul.icu to URL filtering rules, monitor for outbound connections to its IP range, and enforce strict credential‑capture detection on any traffic to this host. Continuous intelligence gathering is advised to capture any evolving tactics or associated infrastructure.