m1p5627x42s22s1y[.]noqucij[.]lol

The domain m1p5627x42s22s1y.noqucij.lol was registered on February 25, 2026 through NameCheap, Inc. and resolves to the IP address 192.64.119.254, which belongs to AS22612 (Namecheap) and is geolocated in the United States. No SSL certificate is presented for the host, indicating the site was served over plain HTTP. The page title returned by the server is "Staking," suggesting an attempt to lure victims with cryptocurrency‑related terminology. VirusTotal reports that eight of ninety‑three security vendors flagged the domain, and Google Safe Browsing classifies it as a social‑engineering threat.

The domain appears on three public blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, reinforcing the assessment of a malicious intent. Current operational status is offline, which may be a temporary takedown or a deliberate shutdown after a campaign burst. Nameservers are dns1.registrar-servers.com and dns2.registrar-servers.com, both typical of the registrar.

While the exact phishing payload has not been captured, the combination of a recent registration, lack of TLS, a cryptocurrency‑themed title, and multiple vendor detections strongly indicates a generic phishing campaign aimed at stealing credentials or funds. Defenders should immediately block the domain and its associated IP address, add the ASN to watchlists, and monitor for similarly structured domains using the same registrar and naming pattern. Continuous observation of the blocklist feeds and safe‑browsing updates is advised to capture any re‑appearance of the site or related infrastructure.