cyberchecks[.]icu

On July 19, 2026, the domain cyberchecks.icu was observed hosting a page that returns HTTP 403 and displays the title "Just a moment…". DNS resolution points to the Cloudflare edge address 104.21.29.61, which is geolocated to Canada and is served by Cloudflare, Inc. The domain’s SSL certificate is issued by Google Trust Services under the WE1 identifier, indicating use of a legitimate certificate authority. Registration records show the domain was created through NICENIC INTERNATIONAL GROUP CO., LIMITED and uses the Cloudflare authoritative nameservers cleo.ns.cloudflare.com and elle.ns.cloudflare.com. The domain is currently listed on a single security blocklist and has been blocked by the PhishDestroy service. VirusTotal analysis shows that five of ninety‑one scanned security vendors flagged the domain, suggesting a moderate level of detection consensus. The exact malicious payload or credential‑harvesting mechanism has not been publicly disclosed; the page content beyond the title remains unverified. Given the high‑risk classification and active status, defenders should block DNS resolution to cyberchecks.icu, monitor outbound connections to the associated IP address, and consider adding the domain to web‑filtering and IDS signatures. Ongoing observation is recommended to capture any changes in content or additional detections.