fun[.]icu

This domain, fun.icu, was registered on May 05 2026 through Key‑Systems LLC and has been assigned a Let’s Encrypt (R13) TLS certificate. The site resolves to the IPv4 address 172.104.149.86, which belongs to a Linode server located in Germany. Both authoritative nameservers – huamei.ns.giantpanda.com and taishan.ns.giantpanda.com – resolve to the same hosting provider, indicating a single‑point infrastructure. The web server returns HTTP 200 and presents a page titled “Checking your browser…”, a common indicator of credential‑harvesting pages that pause execution while the victim’s browser is examined. Gridinsoft assigns the domain a trust score of 0 / 100, and one security blocklist already lists it. VirusTotal records a single positive out of ninety‑five scanning engines, and AlienVault OTX references the domain in one threat pulse. PhishDestroy has actively blocked the URL, confirming that it is currently engaged in malicious activity. Risk is classified as high, and the limited detection footprint suggests a newly deployed campaign that relies on rapid turnover of domains. The presence of a free TLS certificate and a reputable registrar does not mitigate the threat, but the lack of additional vendor detections leaves the full scope of the payload and targeted brands uncertain. No further artifacts, such as malware hashes or phishing email samples, have been disclosed publicly. Defenders should add 172.104.149.86 and the domain fun.icu to inbound and outbound blocklists, enforce DNS filtering of the associated nameservers, and monitor TLS handshakes for unexpected Let’s Encrypt certificates from this IP range. Continuous ingestion of updates from PhishDestroy, VirusTotal, and open‑source threat feeds will help capture any expansion of the campaign. If the site is observed in internal traffic, redirecting users to a safe landing page and collecting request headers can provide additional intelligence for attribution.