indiatoday[.]icu

This domain, indiatoday.icu, is flagged as a credential theft operation designed to impersonate a legitimate news portal. Analysis indicates no direct association with known crypto drainer kits, but the infrastructure mimics trusted media sources to harvest login credentials, payment details, or personal data from unsuspecting visitors. The domain does not exhibit overt brand-specific targeting beyond the implied affiliation with a recognized news outlet, suggesting a broad phishing campaign aimed at readers seeking news content. Infrastructure analysis reveals the domain was registered on December 24, 2025, through Gname.com Pte. Ltd., and currently resolves to the IP address 188.114.97.3, hosted on Cloudflare’s network (AS13335). Security vendor detections on VirusTotal stand at 4/95, while the domain appears on three distinct security blocklists. The SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend false legitimacy. No Google Safe Browsing (GSB) flags are currently recorded, though this may reflect a lag in detection rather than an absence of malicious activity. As of the latest assessment, indiatoday.icu remains active and unmitigated, posing a continued risk to users. Response actions by security providers include blocking by at least three independent systems, though the domain’s Cloudflare-hosted infrastructure complicates takedown efforts. Remaining risk is classified as high due to the domain’s recent registration, low detection rate, and active credential theft operations. Users are advised to avoid interaction, verify URLs through official sources, and report the domain to relevant abuse channels for further investigation.