d58f80q610406e[.]3utilities[.]com

Analysis of d58f80q610406e.3utilities.com indicates that the domain was registered on February 21, 2026 through Vitalwerks Internet Solutions, LLC DBA No‑IP and is serviced by the No‑IP dynamic DNS nameservers nf1.no‑ip.com, nf2.no‑ip.com, nf3.no‑ip.com, nf4.no‑ip.com, and nf5.no‑ip.com. The hostname resolves to IP address 209.97.169.240, which is associated with AS14061 DigitalOcean, LLC and is geolocated to Singapore. No TLS certificate was observed; the site responded over plain HTTP and displayed the default page title “Default Web Site Page”. The domain appears on at least one security blocklist and was actively blocked by the PhishDestroy feed.

Google Safe Browsing flags the host as a social‑engineering threat. VirusTotal scans recorded 21 of 95 security vendors marking the domain as malicious, reinforcing the phishing classification. The current status is offline, with the site taken down at the time of reporting.

While the available indicators confirm phishing‑related activity, the specific payload, targeted brand, or credential‑capture page content has not been disclosed, leaving the exact campaign details uncertain. Defenders should continue to block the domain and its associated IP at perimeter devices, update intrusion‑prevention signatures with the listed indicators, and monitor for any re‑registration attempts or new subdomains using the same registrar or nameserver configuration. Sharing the indicator set with industry threat‑intel feeds is recommended to accelerate broader protection.