fi-ca[.]digital

The domain fi-ca.digital was observed resolving to the IPv4 address 207.174.61.1, which belongs to the Amazon Web Services network (ASN16509) located in the United States. Registration records indicate the domain was created on 11 December 2025 through NameCheap, Inc., and the authoritative name servers are dns1.registrar-servers.com and dns2.registrar-servers.com. The site presented the page title “fi-ca.digital is a custom short domain” and did not serve an SSL/TLS certificate, indicating HTTP‑only delivery. Threat intelligence sources have flagged the domain: it appears on a single security blocklist, is listed in one AlienVault OTX pulse, and is actively blocked by the PhishDestroy service. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious assessment.

VirusTotal scanned the URL with 95 engines, of which five returned positive detections, further corroborating the phishing classification. The current operational status is offline, suggesting the hosting has been taken down or the site has been disabled. Analysis indicates that the infrastructure relies on a cloud provider (AWS) and a low‑cost registrar, a pattern commonly used to reduce attribution and increase turnover of malicious short‑link services. The lack of TLS, the generic page title, and the low trust score point to a purpose-built redirector rather than a legitimate service. No additional content has been captured, so the exact phishing payload, target brand, or credential‑stealing mechanism remains unknown.

Defenders should prioritize immediate blocking of the domain and its resolved IP address at network perimeters. Adding the domain to internal DNS blocklists and updating endpoint security signatures to reflect the five VirusTotal detections will reduce exposure. Continuous monitoring of the associated AWS CIDR ranges for new short‑link domains registered through NameCheap can help identify future replicas.