iconstaff[.]top

This domain, iconstaff.top, is flagged as a high-risk credential harvesting site designed to impersonate internal staff portals of organizations. Analysis indicates the site presents fraudulent login interfaces to deceive employees into submitting corporate credentials, which are then captured by threat actors for unauthorized access or further malicious activities. The use of a deceptive domain name resembling legitimate staff services increases the likelihood of successful phishing attempts against unsuspecting users. Infrastructure analysis reveals the domain was registered on February 28, 2024, through NAMECHEAP INC, a registrar frequently associated with newly created phishing infrastructure. The domain resolves to the IP address 104.21.40.56 and is currently offline, though it previously utilized an SSL certificate issued by Google Trust Services, which was flagged as invalid. Detection metrics show the domain appears on four security blocklists, while AlienVault OTX records it in seven threat intelligence pulses. VirusTotal reports 16 out of 95 security vendors have flagged the domain as malicious, confirming its classification as a phishing threat. Users who visited iconstaff.top or entered credentials on the site should immediately revoke and reset any exposed login details, particularly those associated with corporate accounts. Organizations are advised to block the domain and its resolving IP at the network perimeter and monitor for signs of unauthorized access. Employees should be alerted to the phishing campaign, and security teams should review logs for connections to 104.21.40.56 or interactions with the domain during its active period. Proactive measures, including multi-factor authentication and phishing awareness training, are recommended to mitigate future risks.