smartincomenetwork[.]icu

The domain smartincomenetwork.icu is currently active and has been identified as a credential theft and fraudulent Contract for Difference (CFD) trading platform. Analysis indicates that this site targets individuals seeking investment opportunities in stocks, gold, oil, and indices, presenting itself as a legitimate trading service under the fabricated brand 'Smart Income Network.' The site is designed to harvest user credentials, financial details, and potentially facilitate unauthorized fund transfers under the guise of CFD trading. Infrastructure analysis reveals that the domain was registered on January 22, 2026, through Global Domain Group LLC, a registrar frequently associated with high-risk domains. The site resolves to the IP address 163.61.188.9, which has been linked to other suspicious financial-themed domains in recent months. As of the latest assessment, the domain is flagged by 3 of 95 security vendors on VirusTotal, indicating limited but growing detection. The SSL certificate is issued by Let’s Encrypt, a common choice among threat actors to lend superficial legitimacy to phishing sites. No entries were found on major blocklists such as Google Safe Browsing or PhishTank, suggesting the campaign remains in an early or evasive phase. The current status of smartincomenetwork.icu is active, with no indications of takedown or disruption. Users are strongly advised to avoid interacting with the domain or entering any personal or financial information. Organizations should update web filters to block access to the domain and its associated IP address. Financial institutions and security teams are recommended to monitor for transaction anomalies linked to this infrastructure, particularly those involving CFD trading or unauthorized fund movements. Proactive threat hunting should be conducted across network logs for connections to 163.61.188.9, and affected users should be directed to reset credentials on any accounts accessed via this domain.