onllneaccesnc[.]icu

PhishDestroy identifies onllneaccesnc.icu as a high-risk credential harvesting domain targeting unsuspecting users. This domain mimics legitimate login portals to steal sensitive credentials, posing severe risks to individuals and organizations. The infrastructure appears designed for large-scale deception, leveraging deceptive naming conventions to appear authentic at first glance. No specific brand or drainer kit has been linked to this domain in open-source intelligence, suggesting a generic but potentially effective approach to credential theft.

Technical indicators confirm this domain’s malicious nature. VirusTotal analysis shows 7 out of 95 security vendors flagged this domain as malicious, indicating widespread suspicion but not universal detection. Registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain resolves to IP address 104.21.69.79 and operates under a valid Let’s Encrypt SSL certificate, which may further deceive victims. Created on April 19, 2026, this domain is still active, and its relatively recent registration suggests a rapidly deployed threat. Google Safe Browsing (GSB) status and blocklist participation remain unverified in this dataset, but the low VT detection rate highlights a window of opportunity for attackers.

The current status of onllneaccesnc.icu remains active, with no evidence of takedown or remediation. Users are strongly advised to avoid interacting with this domain and report any encounters to their security teams or platforms like PhishDestroy. Immediate actions include blocking the domain at the network and DNS levels and inspecting endpoints for signs of credential exposure. The remaining risk is high due to the domain’s active status, deceptive design, and the potential for expanded phishing campaigns. Organizations should prioritize user awareness training to mitigate the impact of such credential harvesting attempts.