iconomiteilg[.]com

The domain iconomiteilg.com has been confirmed as a phishing site specifically targeting cryptocurrency users through a fake wallet platform. Analysis indicates the site was designed to mimic legitimate crypto wallet services, likely aiming to harvest credentials or deploy crypto drainer malware. As of the latest assessment, the domain is offline, though prior activity suggests it was actively used in malicious campaigns. Infrastructure analysis reveals the domain was registered through NiceNIC International Group Co., Limited on March 06, 2026, an unusually future-dated creation that may indicate fraudulent registration practices. It resolved to the IP address 185.107.44.123, hosted under AS43350 (NForce Entertainment B.V.) in the Netherlands, a network segment frequently associated with malicious activity. The domain is flagged by 17 of 95 security vendors on VirusTotal, with no SSL certificate present, further reducing its legitimacy. It appears on one security blocklist, and its page title, 'Iconomiteilg | Official Website Platform,' reinforces the attempt to impersonate an authentic service. Current status indicates the domain has been taken offline, likely due to enforcement actions or voluntary takedown. However, the infrastructure remains a potential risk, particularly if the same threat actors re-deploy similar domains. Organizations and users are advised to block the domain and associated IP at the network level, monitor for related indicators of compromise, and educate users on recognizing crypto-themed phishing attempts. Security teams should review logs for connections to 185.107.44.123 and investigate any credential submissions tied to the domain prior to its deactivation.