andersonbonline[.]icu

This domain, andersonbonline.icu, is flagged as an active credential theft infrastructure targeting users through deceptive login portals. Analysis indicates a high-risk classification due to its recent creation, low detection rates, and association with known phishing tactics. The domain impersonates legitimate services to harvest usernames, passwords, and other sensitive authentication data, posing a direct threat to personal and corporate accounts. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 188.114.96.3 and was registered on June 22, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. Security vendors on VirusTotal report 3 out of 95 detections, suggesting limited initial recognition but potential for broader malicious activity. The domain holds a Gridinsoft trust score of 0/100, reinforcing its suspicious nature. An SSL certificate issued by Google Trust Services provides a false sense of security, as encrypted connections are commonly exploited in phishing campaigns to evade detection. Mitigation against credential theft from this domain requires immediate action. Users should avoid accessing andersonbonline.icu and refrain from entering any login credentials on unfamiliar pages. Organizations should block the domain and its associated IP (188.114.96.3) at the network perimeter, including firewalls and email gateways. Security teams are advised to monitor for unusual authentication attempts, particularly from internal accounts that may have interacted with the domain. Multi-factor authentication (MFA) should be enforced to reduce the impact of stolen credentials. If exposure is suspected, affected accounts must be locked, passwords reset, and sessions terminated across all devices.