marketgift[.]icu

This domain, marketgift.icu, is actively engaged in credential theft targeting customers of Leumi Bank, a major financial institution. The page title, "לקוחות לאומי מקבלים מתנה!" (translated: "Leumi customers receive a gift!"), explicitly impersonates the bank to deceive users into entering sensitive login credentials, account details, or personal information under the guise of a promotional offer. Such attacks are designed to harvest data for unauthorized account access, financial fraud, or identity theft, with high success rates due to the convincing mimicry of legitimate banking communications. Analysis indicates multiple technical indicators supporting this assessment. The domain was registered on May 28, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with malicious registrations. It resolves to the IP address 178.16.54.253, hosted on AS202412 (Omegatech LTD) in the Netherlands, a network segment with a history of hosting phishing infrastructure. The domain is flagged by 4 out of 95 security vendors on VirusTotal and appears on 3 distinct security blocklists, including PhishDestroy and SEAL. Additionally, the SSL certificate is issued by Let's Encrypt (YR2), a common choice for threat actors due to its low-cost, automated issuance process, which lacks stringent validation of domain legitimacy. Users who have visited marketgift.icu or interacted with its content should take immediate action to mitigate risk. First, cease all interaction with the domain and refrain from entering any credentials or personal information. If login details or financial data were submitted, contact the impersonated institution (Leumi Bank) directly using verified contact methods to report the incident and initiate account security protocols, such as password resets or transaction monitoring. Monitor bank statements and credit reports for unauthorized activity, and consider enabling multi-factor authentication on all financial accounts. Network administrators should block the domain and its resolving IP (178.16.54.253) at the firewall or DNS level to prevent further exposure within their environments. Given the high-risk nature of this domain, affected users are advised to treat this incident as a potential compromise and act accordingly to secure their digital identities.