verify[.]1d2470101[.]icu

The domain verify.1d2470101.icu was a credential phishing site designed to steal login credentials from victims. It did not impersonate a specific brand or use a known drainer kit. The site is currently taken offline, reducing immediate risk, but prior exposure may still pose a threat to users who entered sensitive information.

Technical analysis shows verify.1d2470101.icu was flagged by 1 of 95 VirusTotal security vendors, including SOCRadar. It appeared on 1 security blocklist (PhishDestroy) and was not flagged by Google Safe Browsing. The domain was created on 2026-02-21 and resolved to the IP address 188.114.97.3, hosted on Cloudflare's network (AS13335). The SSL certificate was issued by WE1, and the observed page title was 'Nur einen Moment…'. Gridinsoft assigned it a trust score of 0/100, further indicating malicious intent.

Users who interacted with verify.1d2470101.icu should immediately change passwords for any accounts entered on the site, prioritizing email, financial, and work-related logins. Enable two-factor authentication (2FA) where available to prevent unauthorized access. Monitor accounts for suspicious activity, such as unauthorized logins or transactions. Report the domain to platforms like Google Safe Browsing, PhishTank, or local cybersecurity authorities to aid in broader threat mitigation.