4y5twe3.icu is a domain on the PhishDestroy blocklist. It does not yet have a final scheme classification, and no impersonated brand has been identified. PhishDestroy first saw it on 2026-08-28. The site went offline on 2026-09-13, and as of 2026-10-19 its DNS no longer resolves, so it is currently unreachable.
How the scam works
The main signal is Spamhaus, which lists the domain in its phishing category. That points to a page built to trick visitors into handing over something valuable, such as login credentials, recovery phrases or a wallet connection that grants spending rights. A meaningless string on a cheap TLD is typical of throwaway domains that are spread through links in messages, ads or social posts rather than found by search. No specific lure, brand or kit can be attributed to this site, so the realistic risk is general phishing: anything typed or signed there should be treated as compromised.
Evidence
On 2026-09-13, 13 of 89 VirusTotal engines flagged the domain. Named vendors include alphaMountain.ai, BitDefender, CRDF, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data and Gridinsoft. Agreement among that many unrelated security vendors, together with the Spamhaus DBL phishing listing, is a stronger signal than any single verdict. The domain also appears in 3 AlienVault OTX threat pulses, so other researchers have tracked it independently.
Infrastructure
The name 4y5twe3 is a random-looking string on the .icu TLD, the kind of disposable address that costs little to replace once blocked. Its short lifespan fits that pattern: it stopped serving content on 2026-09-13, about two weeks after PhishDestroy first saw it. The DNS is now inactive.
What to do
If you entered a password or email on this site, change that password everywhere you reused it and turn on app-based two-factor authentication. If you typed a seed phrase or private key, move your funds to a newly created wallet at once, because that phrase can no longer be trusted. If you connected a wallet or signed anything, review and revoke token approvals with a reputable approval checker and watch the wallet for unexpected transfers. Defenders should block the domain at DNS and proxy level, search mail and chat logs for links to it, and keep it blocked in case it comes back online.
The linked repository preserves daily zone observations across seven ShortDot-operated TLDs, including registration volume and abuse-related indicators. This registry context is supporting background and is not an independent detection for the domain in this report.
对于该 gTLD，上述注册商依据 ICANN 认证协议运营。以下链接提供官方收费标准及现行的 DNS 滥用合规指南。
认证资格只是一份合同，并非安全认证。
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
证书指纹0d0a03c07d743a4671060f56d2a9fb30292e79a6bfd9c2e7ba988c30c82fb663证书名称 · 2 个 SAN
4y5twe3.icu
*.4y5twe3.icu
已保存的证书元数据。未带时区的证书日期按存档原样显示。传输加密并不能证明该网站值得信任。
Latest Classified Outcome 2026-10-21 14:53:36 UTC
Primary outcomeDNS 非活动reason: DNS NXDOMAIN80% confidence
Attributionsource: Dns Cache
Evidence layersAvailability: DNS inactiveContent: UnreachableDNS: NXDOMAINRegistration: Unknown
Latest HTTP observation未知Probe Inconclusive20%2026-10-21 01:00:13 UTC
RDAP registration未知
Observed timelinecurrent episode first observed: 2026-09-30 16:14:55 UTCfirst terminal observation: 2026-09-30 16:14:55 UTC
Availability, content, DNS and registration are independent evidence layers. NXDOMAIN, an unreachable origin or missing content alone does not prove registrar action. A registrar or provider is credited only when a direct technical marker identifies that actor. Report causality is shown separately.
(SE)
