splrush[.]icu

Analysis indicates that splrush.icu is an active generic phishing infrastructure first observed on July 24 2026. The domain resolves to the IP address 188.114.97.3 and is hosted behind Cloudflare, as evidenced by the authoritative nameservers jacob.ns.cloudflare.com and lina.ns.cloudflare.com. Registration records show the domain was created through PDR Ltd. d/b/a PublicDomainRegistry.com, with no further registrant details disclosed. VirusTotal scans show that three of ninety‑one antivirus and URL‑reputation engines have flagged the domain, suggesting a modest but non‑trivial detection rate.

The domain also appears on three public blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its classification as a malicious site. The current risk rating is high, and the status remains active. Concrete evidence beyond the registration and hosting metadata is limited. No public page title, SSL certificate details, HTTP response codes, or Safe Browsing verdicts have been published, leaving the exact phishing lure and targeted brand unidentified.

Consequently, defenders cannot confirm which legitimate service the site attempts to imitate, nor can they assess whether credential‑stealing forms are present. Given the available indicators, security teams should add splrush.icu to DNS‑based deny lists and ensure that endpoint protection solutions ingest the three vendor detections from VirusTotal. Continuous monitoring of the associated IP address and Cloudflare nameservers is advised, as the infrastructure may be reused for additional campaigns. Analysts should also request a full content capture to determine the phishing vector and update detection rules accordingly.