xitadel[.]icu

PhishDestroy identifies xitadel.icu as an active credential harvesting phishing domain impersonating a major financial services brand. This domain is currently classified as an elevated-risk threat with confirmed malicious activity targeting unsuspecting users through fraudulent login portals.

This domain was flagged by 1 of 95 VirusTotal security vendors, resolving to IP address 104.21.4.55 through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain was registered on April 25, 2026, and operates under a Let's Encrypt SSL certificate to appear legitimate. Current threat intelligence indicates this domain remains active despite minimal detection coverage, suggesting it may be newly deployed or employing evasion techniques.

Users should immediately block access to xitadel.icu and avoid entering any credentials on this domain. Organizations are advised to update firewall rules to block IP 104.21.4.55 and implement DNS sinkholing for this domain. Security teams should scan for any internal exposure to this domain and investigate potential credential compromise. Immediate action is critical as this domain represents an active threat with potential for widespread credential theft.