admin[.]circleapp[.]ink

PhishDestroy identifies admin.circleapp.ink as an active credential harvesting domain masquerading as a legitimate Circle app login portal. The domain leverages a generic naming convention to deceive users into surrendering credentials under the guise of 'admin' access. No specific drainer kit artifacts are visible in the initial telemetry, though the domain’s structure suggests a template-based phishing operation designed for rapid deployment. The domain was registered through NAMECHEAP INC on April 29, 2026, and is currently secured with a Let’s Encrypt SSL certificate. It resolves to IP 172.67.149.166 and has not been flagged by VirusTotal, registering 0/95 detections at the time of analysis. Google Safe Browsing (GSB) has no record of prior classification, and no third-party blocklist entries are associated with this domain as of this advisory. The lack of detections highlights a critical window of exposure for potential victims. This domain remains active with an under-investigation risk rating, indicating ongoing analysis by threat intelligence teams. Immediate defensive actions include blocking the domain at DNS and network levels, flagging the IP 172.67.149.166, and updating endpoint rules to detect future iterations. Users are advised to avoid accessing admin.circleapp.ink entirely and report any observed activity via internal phishing channels. While the current risk is unresolved, proactive containment measures significantly reduce the likelihood of successful exploitation.