app[.]rainf[.]icu

app.rainf.icu has been identified as an active fake login portal phishing domain, currently under investigation by PhishDestroy. This domain is being tracked for its role in deceptive credential harvesting campaigns targeting unsuspecting users. The threat remains active as of the latest assessment. This domain was flagged by 0 of 95 VirusTotal vendors, indicating it has not yet been widely detected by security solutions. It was registered through PDR Ltd. d/b/a PublicDomainRegistry.com, resolves to IP 172.67.141.183, and was created on March 30, 2026. Current blocklist counts and trust scores are pending further analysis due to its recent discovery. Users and organizations are advised to avoid interacting with app.rainf.icu and to report any observed phishing activity involving this domain. Implement email filtering rules to block messages referencing this domain or its associated infrastructure. If exposure is suspected, reset credentials and enable multi-factor authentication where applicable to mitigate potential account compromise. Monitor network traffic for connections to IP 172.67.141.183 as an indicator of compromise.