icbc[.]com-safedb[.]cc

The domain icbc.com-safedb.cc was created on June 12, 2026 and is registered through Gname.com Pte. Ltd. It resolves to the IP address 172.67.222.158, which is associated with Cloudflare’s edge network. DNS resolution is handled by the Cloudflare authoritative nameservers marty.ns.cloudflare.com and surina.ns.cloudflare.com. VirusTotal analysis shows that 13 of 91 security vendors flagged the domain as malicious, indicating a measurable detection signal across multiple AV engines.

The domain is listed on one public security blocklist and has been actively blocked by the PhishDestroy feed, reinforcing its classification as a phishing infrastructure element. The threat intelligence rating assigns an elevated risk level and records the current status as active, suggesting ongoing use in malicious campaigns. At present, no publicly available information on TLS certificates, HTTP response codes, page titles, or specific phishing kit details has been disclosed, leaving those aspects unverified.

Defenders should prioritize immediate containment by adding icbc.com-safedb.cc to DNS and URL filtering rules, monitor for any outbound connections to the associated Cloudflare IP, and consider sharing the indicator with partner threat feeds. Continued observation of the domain’s activity, including any changes to its hosting or resolution patterns, is recommended to capture potential evolution of the campaign.