libertymanagement[.]icu

Analysis indicates that libertymanagement.icu is actively hosting a generic phishing campaign. The domain was registered on May 01 2026 and has been assigned a high‑risk rating. Its age of only two months, combined with a zero‑trust score, aligns with typical infrastructure used for rapid‑deployment phishing operations.

The registration record lists NICENIC INTERNATIONAL GROUP CO., LIMITED as the registrar. DNS resolution points to the IP address 188.114.96.3, which is owned by a major content‑delivery provider located in Canada. The domain uses Cloudflare name servers (heather.ns.cloudflare.com and nolan.ns.cloudflare.com) and presents a Let’s Encrypt certificate issued under the E8 profile. An HTTP request to the root returns a 403 status, suggesting intentional restriction of direct access while allowing targeted payload delivery.

Multiple threat‑intelligence feeds have flagged the domain; eight separate pulses reference it, and a security‑scanning platform assigned a trust rating of 0‑out‑of‑100. One out of ninety‑five scanning engines reported a detection, indicating limited but notable suspicion. The domain appears on a single phishing blocklist and is currently blocked by at least one anti‑phishing service.

Defenders should add libertymanagement.icu to outbound web‑filter deny lists and monitor DNS queries for the associated IP address. Email security gateways should be configured to block messages containing links to this domain. Continuous observation of the Cloudflare‑served IP range is advised, as the infrastructure could be repurposed for additional malicious campaigns.