partway[.]icu

The domain partway.icu has been identified as a generic phishing site specializing in fraudulent auto parts transactions. Analysis of the page title, "PartWay — автозапчастини з Європи в Україну," indicates an attempt to impersonate a legitimate auto parts importer or reseller, likely targeting Ukrainian-speaking users seeking European vehicle components. The domain is currently offline, though prior infrastructure remains documented for threat tracking purposes. Infrastructure analysis reveals the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, an offshore registrar frequently associated with high-risk domains. It resolved to the IP address 91.235.128.91, a host previously linked to other phishing campaigns. The domain was created on June 12, 2026, and appears on at least one security blocklist. VirusTotal detection metrics show 5 of 95 security vendors flagging the domain as malicious, with additional blocking by specialized phishing detection systems. No legitimate SSL certificates or historical WHOIS records suggest commercial use, reinforcing the phishing classification. Current status indicates the domain has been taken offline, though residual risk remains for users who may have interacted with it during its active period. Organizations and individuals are advised to implement DNS-based blocking for partway.icu and its associated IP, 91.235.128.91, in perimeter security controls. Endpoint protection should be configured to detect and prevent access to domains registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, particularly those with recent creation dates and automotive-related themes. Users who engaged with the site should verify transaction histories and monitor for unauthorized financial activity, as the domain likely collected payment details under false pretenses.