iconexupdate[.]com

The domain iconexupdate.com was registered on March 6, 2026 through NiceNIC International Group Co., Limited. The domain resolves to the IPv4 address 146.70.41.164, which is advertised as belonging to AS9009 M247 Europe SRL and geolocated to the United States. The site returns HTTP 200 responses and presents a TLS certificate issued by Let’s Encrypt (R12), indicating active HTTPS service. Infrastructure analysis shows the domain is served by the authoritative name servers ns3.my-ndns.com and ns4.my-ndns.com. The host carries a Gridinsoft trust score of 0 out of 100 and is listed on a single security blocklist. PhishDestroy has already blocked the domain, and VirusTotal reports that 1 of 95 security vendors flagged the site as malicious. Observed evidence points to a credential‑phishing campaign. The page title returned by the web server is “iconexupdate.com/”, a pattern commonly used to mimic legitimate updates for the Iconex cryptocurrency wallet. No additional content was captured, so the exact phishing landing page and credential‑collection mechanisms remain unknown, but the combination of a fresh domain, low trust score, and active blocklist placement aligns with known phishing infrastructure. Defenders should add iconexupdate.com to network deny lists and configure DNS filtering to prevent resolution. Continuous monitoring of the associated IP address and name servers is advised, as the operator may repurpose the infrastructure for further campaigns. Incident response teams handling Iconex users should warn end‑users about the fraudulent domain and encourage verification of URLs before entering credentials.