lvy9fhm9h8bj[.]icu

PhishDestroy has identified lvy9fhm9h8bj.icu as a high-risk phishing domain with an elevated threat level. The site is a generic phishing attempt, masquerading as a shopping portal called ANKAmall Alışveriş Merkezi to lure users into entering credentials or financial information. The domain is currently offline, but it was active and dangerous while operational.

Technical analysis reveals multiple red flags. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar often associated with malicious domains. It resolves to IP address 172.67.178.5 and uses an SSL certificate issued by Google Trust Services (WE1). VirusTotal reports that 4 out of 95 security vendors flagged this domain as malicious, and it appears on at least one security blocklist. These indicators collectively point to a well-established phishing infrastructure.

To stay safe, users should never visit lvy9fhm9h8bj.icu or provide any personal or financial information on similar suspicious shopping sites. If you have already entered credentials, change your passwords immediately and enable two-factor authentication on affected accounts. Monitor your financial accounts for unauthorized transactions and report any suspicious activity to your bank. For ongoing protection, use PhishDestroy's browser extension to automatically block known phishing domains and verify unknown sites before interacting with them.