dduc6-3yaaa-aaaal-ai63a-cai[.]icp0[.]io

This domain, dduc6-3yaaa-aaaal-ai63a-cai.icp0.io, was registered on September 6, 2022, through GoDaddy.com, LLC and remains active as of July 12, 2026. Infrastructure analysis reveals it resolves to the IP address 212.71.124.188 and employs HSTS alongside a Let's Encrypt SSL certificate, which may be leveraged to lend an appearance of legitimacy. Six of 95 security vendors on VirusTotal have flagged the domain, and it appears on at least one security blocklist, with additional blocking by PhishDestroy. The Gridinsoft trust score of 0/100 further indicates a high-risk classification. No specific brand impersonation or phishing kit details have been confirmed at this time, and the exact content or target of the phishing campaign remains unanalyzed. The domain's registration age and continued activity suggest it may be part of an established phishing infrastructure rather than a short-lived operation. Defenders should treat this domain as high-risk and prioritize blocking or monitoring traffic to and from 212.71.124.188, particularly for credential harvesting attempts. Additional scrutiny of related subdomains or IPs within the same range may uncover further malicious activity.