botserv[.]tanukicode[.]icu

Analysis of botserv.tanukicode.icu indicates that the domain remains active as of the report date, July 15, 2026. The domain was registered on April 5, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and is hosted on Cloudflare infrastructure, as evidenced by the authoritative name servers apollo.ns.cloudflare.com and sreeni.ns.cloudflare.com. DNS resolution points to the IPv4 address 188.114.97.3. VirusTotal scans show that 2 of 91 security vendors have flagged the domain, suggesting that at least a small subset of detection engines consider it malicious. The threat classification is generic_phishing with a high risk rating, and the current status is listed as active. While the available data confirms the domain’s operational infrastructure and limited vendor detections, no public content analysis or victim reports have been published, leaving the exact phishing payload and target vector uncertain. Defenders should block any network connections to 188.114.97.3 and add botserv.tanukicode.icu to URL filtering lists. Monitoring for new detections on additional security platforms is advised, as further analysis may reveal expanded malicious activity.