inconsk[.]cyou

Analysis indicates that the domain inconsk.cyou was registered on May 16 2026 through Dynadot LLC and is hosted on a server identified as 37.77.150.150, which is geolocated to Russia and associated with the LLC Baxet. The authoritative nameservers ns1.dyna-ns.net and ns2.dyna-ns.net resolve the domain to the same IP address. The site presents a TLS certificate issued by Let’s Encrypt (R12), but an HTTP request returns a 403 status code, suggesting that the web service is intentionally restricting access or that the malicious landing page is hidden behind authentication checks. The only visible page title is “Plesk Obsidian 18.0.77”, indicating that the infrastructure may be masquerading as a Plesk control‑panel login page, a common lure for credential‑stealing campaigns.

Threat intelligence corroborates the malicious nature: AlienVault OTX references the domain in 50 separate pulses, Gridinsoft assigns a trust score of 0 / 100, and VirusTotal reports that 16 of 92 scanning engines flag the domain as malicious. The domain is listed on three public blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. Despite the active blocklist presence, the domain remains live as of the report date (July 23 2026).

Defenders should add inconsk.cyou to URL filtering and endpoint allow‑list exclusions, monitor DNS queries for the associated IP and nameservers, and enforce TLS inspection to capture the hidden content behind the 403 response. Network traffic to the Russian‑based hosting should be inspected for credential‑submission attempts, especially targeting Plesk‑style login endpoints. Given the low trust score and multiple detections, the domain should be treated as high‑risk and blocked at perimeter defenses.