card-promo[.]icu

card-promo.icu has been identified by PhishDestroy as an active brand impersonation scam site. This domain, registered on April 19, 2024, is currently unresolved and hosts a live page designed to mimic legitimate promotional campaigns, likely targeting users with offers for gift cards, discounts, or cryptocurrency bonuses. The threat is categorized as brand impersonation due to the use of a deceptive domain name that suggests affiliation with financial promotions or rewards programs, leveraging trust in recognizable brands to deceive visitors into disclosing personal or payment information.

This domain resolves to IP address 172.67.208.1 and is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. As of the latest scan, VirusTotal shows 0 detections out of 95 antivirus engines, indicating that the site has not yet been widely flagged. The domain uses a Let’s Encrypt SSL certificate, which may further enhance its perceived legitimacy. While no blocklist inclusion has been confirmed, the recent domain creation and absence of detections suggest the scam is in an early operational phase. The combination of a newly registered domain, low detection rate, and SSL certification is a common tactic used by threat actors to evade immediate detection while rapidly deploying fraudulent content.

Users are strongly advised to avoid interacting with card-promo.icu or any associated links promising promotional rewards. If you have visited this site and entered information, cease all further communication and monitor accounts for unauthorized activity. Report the domain to your local cybercrime unit or through platforms such as Google Safe Browsing, PhishTank, or your domain registrar. Organizations should consider proactive blocking of the domain and IP address at the network firewall level to prevent access. Always verify promotional offers directly through official brand websites or trusted channels, and never click on unsolicited links promising financial rewards.