cicis[.]today

This domain, cicis.today, is under investigation for operating as a credential harvesting phishing site targeting users of a well-known pizza chain. The page title, 'Home | Cicis Pizza,' closely resembles the legitimate brand’s interface, increasing the likelihood of successful social engineering attacks. Analysis indicates the site may collect login credentials, payment details, or other sensitive user data under false pretenses, potentially leading to financial fraud or identity theft. Infrastructure analysis reveals the domain was registered on June 18, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.97.3 and has been flagged in 1 threat intelligence pulse on AlienVault OTX. Despite its active status, the domain currently shows 0/95 detections on VirusTotal, suggesting it may still evade automated detection systems. Additionally, it appears on 1 security blocklist, indicating prior suspicion but limited widespread recognition of its malicious nature. Users who have visited cicis.today or entered credentials on the site should immediately revoke any submitted information, particularly if reused across other platforms. Reset passwords for associated accounts using a secure, unrelated device, and monitor financial statements for unauthorized transactions. Network administrators should block the domain and its resolving IP (188.114.97.3) at the perimeter to prevent further exposure. If payment details were entered, contact financial institutions to issue fraud alerts or freeze compromised accounts. Given the domain’s recent creation date and low detection rates, heightened vigilance is advised for potential follow-up attacks.