imperialcrown[.]icu

PhishDestroy identifies imperialcrown.icu as an active credential-harvesting phishing domain targeting unsuspecting users. The campaign remains live and is actively monitored under threat reference seed a3ace7. No specific brand impersonation has been confirmed at this stage of analysis.

This domain was flagged by 9 of 95 VirusTotal vendors at the time of analysis, indicating it remains undetected by mainstream security engines. It resolves to IP address 104.21.13.143, utilizes a Let's Encrypt SSL certificate, and was registered on March 21, 2026 through Fewmoretaps OU d/b/a Trustname.com. With no current presence on public blocklists and no trust score data available, the domain presents elevated risk due to its recent creation and active infrastructure.

The domain imperialcrown.icu is classified as an active credential-harvesting campaign and poses imminent risk to individuals or organizations who may receive or encounter its links. Users are advised to avoid accessing this domain entirely. Network defenders should implement firewall rules to block traffic to 104.21.13.143 and monitor DNS resolutions to imperialcrown.icu. Immediate reporting to security teams and updating threat intelligence feeds is recommended to prevent potential data compromise.