resmi-girisi[.]icu

The domain resmi-girisi.icu was registered on May 01, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently active. It is protected by a Let’s Encrypt certificate (profile E8) and resolves to the Cloudflare‑managed address 104.21.60.113. The site returns an HTTP 403 status code, indicating that direct content retrieval is blocked or restricted.

Infrastructure analysis shows the host IP is assigned to a Cloudflare network located in Canada, and the domain uses the default Cloudflare authoritative nameservers craig.ns.cloudflare.com and gracie.ns.cloudflare.com. The use of Cloudflare’s edge services is consistent with a strategy to hide the true origin server and to benefit from DDoS mitigation and SSL termination.

Detection feeds have flagged the domain as malicious. Four out of ninety‑five antivirus engines on VirusTotal have marked the host as suspicious, and Gridinsoft assigns a trust score of 0 out of 100. The domain appears on a single public blocklist and is referenced in one AlienVault OTX pulse. PhishDestroy has already added the domain to its blocklist, confirming active mitigation by external defenders.

Because the site returns only a 403 response, the exact phishing payload or credential‑harvesting page cannot be examined, leaving the specific lure and target brand unknown. Defenders should continue to block the domain at network perimeter, update DNS filtering policies, and consider sinkholing the IP address to prevent future abuse. Continuous monitoring of the IP and associated Cloudflare accounts is advised, as the infrastructure could be repurposed for additional campaigns.