A phishing campaign used invisible Unicode characters to evade email filters. WhoisXML API analyzed its domain and IP indicators, uncovering 165 connected artifacts, 158 undetected by engines listed on VirusTotal.