ssixca[.]com

Analysis of ssixca.com indicates active phishing infrastructure targeting financial credentials. The domain was registered on May 25, 2026, through a privacy-protected registrar and currently resolves to 198.54.117.242, an address hosted on a US-based provider. Infrastructure review shows Cloudflare nameservers (samara.ns.cloudflare.com and santino.ns.cloudflare.com) and no SSL certificate, which is atypical for legitimate financial services but common in phishing campaigns to avoid certificate transparency logs. The domain returns an HTTP 200 status, suggesting an operational landing page, though the specific brand impersonation remains unconfirmed without deeper inspection of the page content. Security vendors have flagged ssixca.com with moderate consensus: six out of ninety-five engines on a multi-scanner platform detect malicious activity, while one commercial blocklist has added the domain to its denylist. The absence of an SSL certificate and the use of Cloudflare nameservers may help defenders identify similar phishing domains, though these characteristics alone are not definitive proof of malicious intent. The domain’s creation date, recent and within a timeframe consistent with active phishing operations, aligns with observed patterns of short-lived credential harvesting sites. Defenders should treat ssixca.com as high-risk due to its technical indicators and detection history. Network-level blocking is recommended for organizations, particularly those handling financial transactions or user authentication workflows. If the domain is encountered in logs, analysts should check for associated outbound connections to 198.54.117.242 and review any user interactions with the site for potential credential exposure. Given the domain’s recent registration and active status, monitoring for changes in hosting or nameserver configurations may provide additional context for ongoing campaigns.