aukta-cqaaa-aaaak-qclnq-cai[.]icp0[.]io

This domain, aukta-cqaaa-aaaak-qclnq-cai.icp0.io, is flagged for brand impersonation targeting foundation-related entities. The page title, MetalSwap Webapp, suggests an attempt to mimic legitimate decentralized finance platforms or cryptocurrency services, a common tactic in credential harvesting and fraudulent token distribution schemes. No specific drainer kit signatures were identified in preliminary analysis, but the infrastructure aligns with known patterns of brand spoofing campaigns designed to deceive users into disclosing sensitive information or transferring assets to attacker-controlled wallets.

Infrastructure analysis reveals multiple technical indicators of compromise. The domain was registered through GoDaddy.com, LLC on September 06, 2022, and resolves to the IPv6 address 2a00:fb01:400:200:5000:61ff:fe45:43ab. It is detected by 6 out of 95 security engines on VirusTotal, with a Gridinsoft trust score of 0/100. The domain appears on one security blocklist and is flagged by PhishDestroy. The SSL certificate is issued by Let's Encrypt, and HTTP Strict Transport Security (HSTS) is enforced, which may be leveraged to lend an appearance of legitimacy to the fraudulent site.

The domain is currently offline, likely due to takedown actions or abandonment by the threat actor. However, residual risk remains elevated due to the domain's historical use in brand impersonation campaigns. Organizations and users are advised to monitor for re-emergence of this domain or similar infrastructure under new registrations. Network defenders should update blocklists to include this domain and its associated IP address, while end-users should be educated on recognizing brand impersonation tactics, particularly in decentralized finance and cryptocurrency contexts. Continuous monitoring of related domains and certificate transparency logs is recommended to identify potential follow-up campaigns.