signedvault[.]icu

This domain, signedvault.icu, is identified as a credential theft phishing site. It poses a significant risk to users by attempting to capture sensitive information such as usernames, passwords, and other personal data. The domain is designed to mimic legitimate login pages, tricking users into entering their credentials, which are then stolen by the attackers.

Analysis indicates that the domain has been flagged by 6 out of 95 security vendors on VirusTotal, suggesting that it has been recognized as malicious by a subset of the security community. The domain was registered through NiceNIC International Group Co., Limited on February 26, 2026, and has appeared on three security blocklists. These indicators, combined with the fact that the domain has been taken offline, suggest that it was actively used for phishing attacks before being shut down.

If users have visited this domain, they should immediately change their passwords for any accounts they may have entered credentials into. Additionally, users should monitor their accounts for any unauthorized activity and consider enabling two-factor authentication (2FA) for added security. It is also recommended to run a full system scan to ensure that no malware was installed as a result of visiting the site.