income-usdc[.]icu

Analysis of income-usdc.icu shows a high‑risk generic phishing campaign that is currently active. The domain was registered on May 15, 2026 through Gname.com Pte. Ltd. and resolves to the IPv4 address 34.81.115.235, a Google Cloud node in the Taiwan (asia‑east1) region. DNS is served by a10.share-dns.com and b10.share-dns.net. An HTTPS endpoint is present, secured with a Let’s Encrypt certificate (issuer E7) that returns HTTP 200 on request. Reputation data indicates a Gridinsoft trust score of 0/100, placement on three public security blocklists, and detection by PhishDestroy, MetaMask and SEAL. VirusTotal scans show 12 of 92 security vendors flagging the domain as malicious, and AlienVault OTX references the domain in a single threat‑intel pulse. The combined evidence—recent creation, cloud‑hosted IP, low trust score, multiple blocklist listings, and vendor detections—confirms the domain’s use for phishing. Uncertainty remains regarding the specific content served, as no page‑level analysis is available. Defenders should block the domain and its resolving IP at network perimeters, ingest the associated IP and nameserver data into threat‑intel platforms, and monitor the certificate for future changes. Continuous re‑evaluation is advised as additional telemetry becomes available.