immutable[.]fyi

This domain, immutable.fyi, was registered on March 11, 2026, and is currently flagged as a high-risk generic phishing site. Analysis indicates it impersonates a code-sharing or legal documentation platform, as suggested by its page title, 'LegalCode - Immutable Code Sharing.' The domain resolves to IP 38.180.114.102, hosted on AS58061 (Scalaxy B.V.) in the Netherlands, and uses nameservers ns09.domaincontrol.com and ns10.domaincontrol.com. It remains active with an HTTP 200 status and employs a Let's Encrypt SSL certificate (R12). Infrastructure review reveals the domain appears on three security blocklists and has been included in two AlienVault OTX threat intelligence pulses. Two of 94 security vendors on VirusTotal have flagged the domain as malicious. It is currently blocked by PhishDestroy, MetaMask, and SEAL. The domain was registered through GoDaddy.com, LLC, a common registrar for both legitimate and malicious domains. While the exact phishing mechanism or payload remains unconfirmed, the combination of a deceptive page title, recent registration, and presence on multiple blocklists suggests an intent to deceive users seeking code-sharing or legal documentation services. Defenders should treat this domain as actively malicious and prioritize blocking it at the DNS or network level. Further analysis of the site's content and payload delivery methods is recommended to determine the full scope of the threat.