calicio-ltd[.]com

This domain, calicio-ltd.com, is identified as a credential-harvesting phishing site specifically designed to mimic cryptocurrency wallet interfaces. Analysis indicates the site employs social engineering tactics to trick users into entering private keys or recovery phrases, which are then exfiltrated to attacker-controlled servers. No specific brand impersonation or drainer kit signatures have been confirmed at this stage, though the infrastructure aligns with known crypto-phishing campaigns observed in recent threat intelligence reports. Infrastructure analysis reveals the following technical indicators: the domain currently holds a VirusTotal detection score of 0/95, indicating no antivirus engines have flagged it yet, though it appears in 4 AlienVault OTX threat intelligence pulses. The domain was registered on June 10, 2026, through Tucows Domains Inc. and resolves to the IP address 104.21.64.220, which is protected by Cloudflare’s network. It has been blocked by at least one security blocklist, and no Google Safe Browsing flags have been recorded as of the latest scan. The use of HTTP/3 further suggests an attempt to leverage modern web protocols for improved performance and evasion. The domain has been taken offline, likely due to enforcement actions following its detection on security blocklists and threat intelligence platforms. While the immediate threat has been mitigated, residual risk remains for users who may have interacted with the site prior to its takedown. Organizations are advised to monitor network logs for connections to 104.21.64.220 and review endpoint telemetry for signs of credential compromise. Proactive measures, such as domain sinkholing and DNS filtering, should be considered to prevent future access attempts.