app[.]karnino[.]icu

The domain app.karnino.icu has been identified as a credential phishing infrastructure targeting users through deceptive login portals. Analysis confirms this domain was actively used to harvest authentication credentials by mimicking legitimate service interfaces. As of the latest assessment, the domain has been taken offline, though residual risk may persist due to prior exposure. Infrastructure analysis reveals the domain was registered on November 11, 2025, through NiceNIC International Group Co., Limited. It resolves to the IP address 172.67.179.35, a host commonly associated with content delivery networks that may obscure malicious activity. The domain is flagged by 9 of 95 security vendors on VirusTotal, indicating a consensus on its malicious nature. Additional data points include a Gridinsoft trust score of 0/100 and its presence on one security blocklist. The page title, www.www.app.karnino.icu, suggests poor operational security, as the redundant subdomain structure is atypical for legitimate services. Current status indicates the domain is offline, reducing immediate threat exposure. However, organizations and users should remain vigilant for residual phishing attempts leveraging similar domains or infrastructure. Recommended actions include blocking the domain and its associated IP (172.67.179.35) at the network perimeter, updating endpoint protection rules to detect related indicators, and conducting retrospective log analysis to identify prior interactions. Users who may have engaged with the domain should reset credentials for any accounts accessed during the exposure window and enable multi-factor authentication where available.