aypwusrzmtumicunckinfvxhaplcebjqy[.]com

Analysis of the domain aypwusrzmtumicunckinfvxhaplcebjqy.com indicates it was actively used for credential phishing prior to being taken offline on or before July 24, 2026. The domain was registered on October 3, 2025, through NiceNIC International Group Co., Limited, a registrar frequently observed in phishing infrastructure. It resolved to the IP address 138.199.40.58, hosted under AS60068 (Datacamp Limited) in the United States. No SSL certificate was detected, increasing the likelihood of interception or manipulation of unencrypted traffic. Nameservers coco.bunny.net and kiki.bunny.net were assigned, a configuration consistent with bulletproof or low-cost hosting providers commonly exploited by threat actors.

Security vendor detection on VirusTotal reached 11 of 95 engines, a moderate but notable signal of malicious activity. The domain appears on one security blocklist and was blocked by PhishDestroy, further corroborating its classification as phishing infrastructure. AlienVault OTX records the domain in a single threat intelligence pulse, suggesting limited but confirmed exposure in threat-sharing communities. Gridinsoft assigned a trust score of 0/100, reflecting high confidence in its malicious designation.

No specific brand or service was identified in the available data, and the exact content of the phishing page remains unanalysed. However, the combination of infrastructure characteristics—including the lack of encryption, use of high-risk hosting, and detection by multiple security vendors—supports its classification as a generic credential phishing domain. Defenders should treat any historical traffic to this domain as potentially compromised and review logs for connections from internal networks. While the domain is currently offline, monitoring for re-registration or reuse of associated IP addresses and nameservers is recommended.