trustcoassist[.]icu

The domain trustcoassist.icu was registered on April 21, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently resolved to the IP address 188.114.96.3. The name servers mack.ns.cloudflare.com and teagan.ns.cloudflare.com indicate that the domain is fronted by Cloudflare infrastructure, with the IP geolocated to Canada. The site presents an HTTP 403 response and serves a Let’s Encrypt certificate (E7), confirming active TLS on the host.

Detection footprints show that the domain is listed on a single security blocklist and has been flagged by the PhishDestroy blocklist. AlienVault OTX reports the domain in one threat‑intelligence pulse, and VirusTotal analysis records a single positive detection out of 95 security vendors, demonstrating that at least one scanner identified malicious behavior. The Gridinsoft trust score of 0 out of 100 reinforces the assessment of high risk.

Infrastructure analysis confirms that the domain remains active despite the blocking actions. No additional contextual data, such as page content or targeted brand, is available at this time, limiting the ability to attribute the phishing campaign to a specific lure or victim set. The limited number of blocklist appearances and the solitary VirusTotal flag suggest that detection coverage may be incomplete, and further investigation is warranted to establish the full scope of the campaign.

Defenders should immediately add trustcoassist.icu to local and upstream deny lists, enforce DNS filtering, and monitor outbound connections to the associated Cloudflare IP. Continuous re‑query of reputation services is advised to capture any escalation in detection counts. Network traffic to the IP should be inspected for credential harvesting attempts, and any compromised credentials should be rotated. Organizations are encouraged to share additional indicators of compromise with information‑sharing communities to broaden collective visibility of this high‑risk generic phishing operation.